Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (56 commits)
  netns: Fix crash by making igmp per namespace
  bnx2x: Version update
  bnx2x: Checkpatch compliance
  bnx2x: Spelling mistakes
  bnx2x: Minor code improvements
  bnx2x: Driver info
  bnx2x: 1G LED does not turn off
  bnx2x: 8073 PHY changes
  bnx2x: Change GPIO for any port
  bnx2x: Pause settings
  bnx2x: Link order with external PHY
  bnx2x: No LRO without Rx checksum
  bnx2x: Wrong structure size
  bnx2x: WoL capability
  bnx2x: Clearing MAC addresses filters
  bnx2x: Delay in while loops
  bnx2x: PBA Table Page Alignment Workaround
  bnx2x: Self-test false positive
  bnx2x: Memory allocation
  bnx2x: HW attention lock
  ...

32 files changed, 196 insertions, 199 deletions

diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
index 57abe8266be1..a89f32fa94f6 100644
--- a/net/core/gen_estimator.c
+++ b/net/core/gen_estimator.c
@@ -99,7 +99,7 @@ struct gen_estimator_head
 
 static struct gen_estimator_head elist[EST_MAX_INTERVAL+1];
 
-/* Protects against NULL dereference */
+/* Protects against NULL dereference and RCU write-side */
 static DEFINE_RWLOCK(est_lock);
 
 static void est_timer(unsigned long arg)
@@ -185,6 +185,7 @@ int gen_new_estimator(struct gnet_stats_basic *bstats,
         est->last_packets = bstats->packets;
         est->avpps = rate_est->pps<<10;
 
+        write_lock_bh(&est_lock);
         if (!elist[idx].timer.function) {
                 INIT_LIST_HEAD(&elist[idx].list);
                 setup_timer(&elist[idx].timer, est_timer, idx);
@@ -194,6 +195,7 @@ int gen_new_estimator(struct gnet_stats_basic *bstats,
                 mod_timer(&elist[idx].timer, jiffies + ((HZ/4) << idx));
 
         list_add_rcu(&est->list, &elist[idx].list);
+        write_unlock_bh(&est_lock);
         return 0;
 }
 
@@ -212,7 +214,6 @@ static void __gen_kill_estimator(struct rcu_head *head)
  * Removes the rate estimator specified by &bstats and &rate_est
  * and deletes the timer.
  *
- * NOTE: Called under rtnl_mutex
  */
 void gen_kill_estimator(struct gnet_stats_basic *bstats,
         struct gnet_stats_rate_est *rate_est)
@@ -226,17 +227,17 @@ void gen_kill_estimator(struct gnet_stats_basic *bstats,
                 if (!elist[idx].timer.function)
                         continue;
 
+                write_lock_bh(&est_lock);
                 list_for_each_entry_safe(e, n, &elist[idx].list, list) {
                         if (e->rate_est != rate_est || e->bstats != bstats)
                                 continue;
 
-                        write_lock_bh(&est_lock);
                         e->bstats = NULL;
-                        write_unlock_bh(&est_lock);
 
                         list_del_rcu(&e->list);
                         call_rcu(&e->e_rcu, __gen_kill_estimator);
                 }
+                write_unlock_bh(&est_lock);
         }
 }
 
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 526236453908..a756847e3814 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -1961,6 +1961,8 @@ static int pktgen_setup_dev(struct pktgen_dev *pkt_dev, const char *ifname)
  */
 static void pktgen_setup_inject(struct pktgen_dev *pkt_dev)
 {
+        int ntxq;
+
         if (!pkt_dev->odev) {
                 printk(KERN_ERR "pktgen: ERROR: pkt_dev->odev == NULL in "
                        "setup_inject.\n");
@@ -1969,6 +1971,33 @@ static void pktgen_setup_inject(struct pktgen_dev *pkt_dev)
                 return;
         }
 
+        /* make sure that we don't pick a non-existing transmit queue */
+        ntxq = pkt_dev->odev->real_num_tx_queues;
+        if (ntxq <= num_online_cpus() && (pkt_dev->flags & F_QUEUE_MAP_CPU)) {
+                printk(KERN_WARNING "pktgen: WARNING: QUEUE_MAP_CPU "
+                       "disabled because CPU count (%d) exceeds number ",
+                       num_online_cpus());
+                printk(KERN_WARNING "pktgen: WARNING: of tx queues "
+                       "(%d) on %s \n", ntxq, pkt_dev->odev->name);
+                pkt_dev->flags &= ~F_QUEUE_MAP_CPU;
+        }
+        if (ntxq <= pkt_dev->queue_map_min) {
+                printk(KERN_WARNING "pktgen: WARNING: Requested "
+                       "queue_map_min (%d) exceeds number of tx\n",
+                       pkt_dev->queue_map_min);
+                printk(KERN_WARNING "pktgen: WARNING: queues (%d) on "
+                       "%s, resetting\n", ntxq, pkt_dev->odev->name);
+                pkt_dev->queue_map_min = ntxq - 1;
+        }
+        if (ntxq <= pkt_dev->queue_map_max) {
+                printk(KERN_WARNING "pktgen: WARNING: Requested "
+                       "queue_map_max (%d) exceeds number of tx\n",
+                       pkt_dev->queue_map_max);
+                printk(KERN_WARNING "pktgen: WARNING: queues (%d) on "
+                       "%s, resetting\n", ntxq, pkt_dev->odev->name);
+                pkt_dev->queue_map_max = ntxq - 1;
+        }
+
         /* Default to the interface's mac if not explicitly set. */
 
         if (is_zero_ether_addr(pkt_dev->src_mac))
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index b622d9744856..1ca3b26eed0f 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -474,6 +474,11 @@ static int dccp_setsockopt_change(struct sock *sk, int type,
 
         if (copy_from_user(&opt, optval, sizeof(opt)))
                 return -EFAULT;
+        /*
+         * rfc4340: 6.1. Change Options
+         */
+        if (opt.dccpsf_len < 1)
+                return -EINVAL;
 
         val = kmalloc(opt.dccpsf_len, GFP_KERNEL);
         if (!val)
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 6203ece53606..f70fac612596 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -289,6 +289,7 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
         struct rtable *rt;
         struct iphdr *pip;
         struct igmpv3_report *pig;
+        struct net *net = dev_net(dev);
 
         skb = alloc_skb(size + LL_ALLOCATED_SPACE(dev), GFP_ATOMIC);
         if (skb == NULL)
@@ -299,7 +300,7 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
                                     .nl_u = { .ip4_u = {
                                     .daddr = IGMPV3_ALL_MCR } },
                                     .proto = IPPROTO_IGMP };
-                if (ip_route_output_key(&init_net, &rt, &fl)) {
+                if (ip_route_output_key(net, &rt, &fl)) {
                         kfree_skb(skb);
                         return NULL;
                 }
@@ -629,6 +630,7 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
         struct igmphdr *ih;
         struct rtable *rt;
         struct net_device *dev = in_dev->dev;
+        struct net *net = dev_net(dev);
         __be32  group = pmc ? pmc->multiaddr : 0;
         __be32  dst;
 
@@ -643,7 +645,7 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
                 struct flowi fl = { .oif = dev->ifindex,
                                     .nl_u = { .ip4_u = { .daddr = dst } },
                                     .proto = IPPROTO_IGMP };
-                if (ip_route_output_key(&init_net, &rt, &fl))
+                if (ip_route_output_key(net, &rt, &fl))
                         return -1;
         }
         if (rt->rt_src == 0) {
@@ -1196,9 +1198,6 @@ void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
 
         ASSERT_RTNL();
 
-        if (!net_eq(dev_net(in_dev->dev), &init_net))
-                return;
-
         for (im=in_dev->mc_list; im; im=im->next) {
                 if (im->multiaddr == addr) {
                         im->users++;
@@ -1278,9 +1277,6 @@ void ip_mc_dec_group(struct in_device *in_dev, __be32 addr)
 
         ASSERT_RTNL();
 
-        if (!net_eq(dev_net(in_dev->dev), &init_net))
-                return;
-
         for (ip=&in_dev->mc_list; (i=*ip)!=NULL; ip=&i->next) {
                 if (i->multiaddr==addr) {
                         if (--i->users == 0) {
@@ -1308,9 +1304,6 @@ void ip_mc_down(struct in_device *in_dev)
 
         ASSERT_RTNL();
 
-        if (!net_eq(dev_net(in_dev->dev), &init_net))
-                return;
-
         for (i=in_dev->mc_list; i; i=i->next)
                 igmp_group_dropped(i);
 
@@ -1331,9 +1324,6 @@ void ip_mc_init_dev(struct in_device *in_dev)
 {
         ASSERT_RTNL();
 
-        if (!net_eq(dev_net(in_dev->dev), &init_net))
-                return;
-
         in_dev->mc_tomb = NULL;
 #ifdef CONFIG_IP_MULTICAST
         in_dev->mr_gq_running = 0;
@@ -1357,9 +1347,6 @@ void ip_mc_up(struct in_device *in_dev)
 
         ASSERT_RTNL();
 
-        if (!net_eq(dev_net(in_dev->dev), &init_net))
-                return;
-
         ip_mc_inc_group(in_dev, IGMP_ALL_HOSTS);
 
         for (i=in_dev->mc_list; i; i=i->next)
@@ -1376,9 +1363,6 @@ void ip_mc_destroy_dev(struct in_device *in_dev)
 
         ASSERT_RTNL();
 
-        if (!net_eq(dev_net(in_dev->dev), &init_net))
-                return;
-
         /* Deactivate timers */
         ip_mc_down(in_dev);
 
@@ -1395,7 +1379,7 @@ void ip_mc_destroy_dev(struct in_device *in_dev)
         write_unlock_bh(&in_dev->mc_list_lock);
 }
 
-static struct in_device * ip_mc_find_dev(struct ip_mreqn *imr)
+static struct in_device *ip_mc_find_dev(struct net *net, struct ip_mreqn *imr)
 {
         struct flowi fl = { .nl_u = { .ip4_u =
                                       { .daddr = imr->imr_multiaddr.s_addr } } };
@@ -1404,19 +1388,19 @@ static struct in_device * ip_mc_find_dev(struct ip_mreqn *imr)
         struct in_device *idev = NULL;
 
         if (imr->imr_ifindex) {
-                idev = inetdev_by_index(&init_net, imr->imr_ifindex);
+                idev = inetdev_by_index(net, imr->imr_ifindex);
                 if (idev)
                         __in_dev_put(idev);
                 return idev;
         }
         if (imr->imr_address.s_addr) {
-                dev = ip_dev_find(&init_net, imr->imr_address.s_addr);
+                dev = ip_dev_find(net, imr->imr_address.s_addr);
                 if (!dev)
                         return NULL;
                 dev_put(dev);
         }
 
-        if (!dev && !ip_route_output_key(&init_net, &rt, &fl)) {
+        if (!dev && !ip_route_output_key(net, &rt, &fl)) {
                 dev = rt->u.dst.dev;
                 ip_rt_put(rt);
         }
@@ -1754,18 +1738,16 @@ int ip_mc_join_group(struct sock *sk , struct ip_mreqn *imr)
         struct ip_mc_socklist *iml=NULL, *i;
         struct in_device *in_dev;
         struct inet_sock *inet = inet_sk(sk);
+        struct net *net = sock_net(sk);
         int ifindex;
         int count = 0;
 
         if (!ipv4_is_multicast(addr))
                 return -EINVAL;
 
-        if (!net_eq(sock_net(sk), &init_net))
-                return -EPROTONOSUPPORT;
-
         rtnl_lock();
 
-        in_dev = ip_mc_find_dev(imr);
+        in_dev = ip_mc_find_dev(net, imr);
 
         if (!in_dev) {
                 iml = NULL;
@@ -1827,15 +1809,13 @@ int ip_mc_leave_group(struct sock *sk, struct ip_mreqn *imr)
         struct inet_sock *inet = inet_sk(sk);
         struct ip_mc_socklist *iml, **imlp;
         struct in_device *in_dev;
+        struct net *net = sock_net(sk);
         __be32 group = imr->imr_multiaddr.s_addr;
         u32 ifindex;
         int ret = -EADDRNOTAVAIL;
 
-        if (!net_eq(sock_net(sk), &init_net))
-                return -EPROTONOSUPPORT;
-
         rtnl_lock();
-        in_dev = ip_mc_find_dev(imr);
+        in_dev = ip_mc_find_dev(net, imr);
         ifindex = imr->imr_ifindex;
         for (imlp = &inet->mc_list; (iml = *imlp) != NULL; imlp = &iml->next) {
                 if (iml->multi.imr_multiaddr.s_addr != group)
@@ -1873,21 +1853,19 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
         struct in_device *in_dev = NULL;
         struct inet_sock *inet = inet_sk(sk);
         struct ip_sf_socklist *psl;
+        struct net *net = sock_net(sk);
         int leavegroup = 0;
         int i, j, rv;
 
         if (!ipv4_is_multicast(addr))
                 return -EINVAL;
 
-        if (!net_eq(sock_net(sk), &init_net))
-                return -EPROTONOSUPPORT;
-
         rtnl_lock();
 
         imr.imr_multiaddr.s_addr = mreqs->imr_multiaddr;
         imr.imr_address.s_addr = mreqs->imr_interface;
         imr.imr_ifindex = ifindex;
-        in_dev = ip_mc_find_dev(&imr);
+        in_dev = ip_mc_find_dev(net, &imr);
 
         if (!in_dev) {
                 err = -ENODEV;
@@ -2007,6 +1985,7 @@ int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
         struct in_device *in_dev;
         struct inet_sock *inet = inet_sk(sk);
         struct ip_sf_socklist *newpsl, *psl;
+        struct net *net = sock_net(sk);
         int leavegroup = 0;
 
         if (!ipv4_is_multicast(addr))
@@ -2015,15 +1994,12 @@ int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
             msf->imsf_fmode != MCAST_EXCLUDE)
                 return -EINVAL;
 
-        if (!net_eq(sock_net(sk), &init_net))
-                return -EPROTONOSUPPORT;
-
         rtnl_lock();
 
         imr.imr_multiaddr.s_addr = msf->imsf_multiaddr;
         imr.imr_address.s_addr = msf->imsf_interface;
         imr.imr_ifindex = ifindex;
-        in_dev = ip_mc_find_dev(&imr);
+        in_dev = ip_mc_find_dev(net, &imr);
 
         if (!in_dev) {
                 err = -ENODEV;
@@ -2094,19 +2070,17 @@ int ip_mc_msfget(struct sock *sk, struct ip_msfilter *msf,
         struct in_device *in_dev;
         struct inet_sock *inet = inet_sk(sk);
         struct ip_sf_socklist *psl;
+        struct net *net = sock_net(sk);
 
         if (!ipv4_is_multicast(addr))
                 return -EINVAL;
 
-        if (!net_eq(sock_net(sk), &init_net))
-                return -EPROTONOSUPPORT;
-
         rtnl_lock();
 
         imr.imr_multiaddr.s_addr = msf->imsf_multiaddr;
         imr.imr_address.s_addr = msf->imsf_interface;
         imr.imr_ifindex = 0;
-        in_dev = ip_mc_find_dev(&imr);
+        in_dev = ip_mc_find_dev(net, &imr);
 
         if (!in_dev) {
                 err = -ENODEV;
@@ -2163,9 +2137,6 @@ int ip_mc_gsfget(struct sock *sk, struct group_filter *gsf,
         if (!ipv4_is_multicast(addr))
                 return -EINVAL;
 
-        if (!net_eq(sock_net(sk), &init_net))
-                return -EPROTONOSUPPORT;
-
         rtnl_lock();
 
         err = -EADDRNOTAVAIL;
@@ -2246,19 +2217,17 @@ void ip_mc_drop_socket(struct sock *sk)
 {
         struct inet_sock *inet = inet_sk(sk);
         struct ip_mc_socklist *iml;
+        struct net *net = sock_net(sk);
 
         if (inet->mc_list == NULL)
                 return;
 
-        if (!net_eq(sock_net(sk), &init_net))
-                return;
-
         rtnl_lock();
         while ((iml = inet->mc_list) != NULL) {
                 struct in_device *in_dev;
                 inet->mc_list = iml->next;
 
-                in_dev = inetdev_by_index(&init_net, iml->multi.imr_ifindex);
+                in_dev = inetdev_by_index(net, iml->multi.imr_ifindex);
                 (void) ip_mc_leave_src(sk, iml, in_dev);
                 if (in_dev != NULL) {
                         ip_mc_dec_group(in_dev, iml->multi.imr_multiaddr.s_addr);
diff --git a/net/ipv4/ipvs/ip_vs_app.c b/net/ipv4/ipvs/ip_vs_app.c
index 1f1897a1a702..201b8ea3020d 100644
--- a/net/ipv4/ipvs/ip_vs_app.c
+++ b/net/ipv4/ipvs/ip_vs_app.c
@@ -608,7 +608,7 @@ int ip_vs_skb_replace(struct sk_buff *skb, gfp_t pri,
 }
 
 
-int ip_vs_app_init(void)
+int __init ip_vs_app_init(void)
 {
         /* we will replace it with proc_net_ipvs_create() soon */
         proc_net_fops_create(&init_net, "ip_vs_app", 0, &ip_vs_app_fops);
diff --git a/net/ipv4/ipvs/ip_vs_conn.c b/net/ipv4/ipvs/ip_vs_conn.c
index f8bdae47a77f..44a6872dc245 100644
--- a/net/ipv4/ipvs/ip_vs_conn.c
+++ b/net/ipv4/ipvs/ip_vs_conn.c
@@ -965,7 +965,7 @@ static void ip_vs_conn_flush(void)
 }
 
 
-int ip_vs_conn_init(void)
+int __init ip_vs_conn_init(void)
 {
         int idx;
 
diff --git a/net/ipv4/ipvs/ip_vs_ctl.c b/net/ipv4/ipvs/ip_vs_ctl.c
index 9a5ace0b4dd6..6379705a8dcb 100644
--- a/net/ipv4/ipvs/ip_vs_ctl.c
+++ b/net/ipv4/ipvs/ip_vs_ctl.c
@@ -683,9 +683,22 @@ static void
 ip_vs_zero_stats(struct ip_vs_stats *stats)
 {
         spin_lock_bh(&stats->lock);
-        memset(stats, 0, (char *)&stats->lock - (char *)stats);
-        spin_unlock_bh(&stats->lock);
+
+        stats->conns = 0;
+        stats->inpkts = 0;
+        stats->outpkts = 0;
+        stats->inbytes = 0;
+        stats->outbytes = 0;
+
+        stats->cps = 0;
+        stats->inpps = 0;
+        stats->outpps = 0;
+        stats->inbps = 0;
+        stats->outbps = 0;
+
         ip_vs_zero_estimator(stats);
+
+        spin_unlock_bh(&stats->lock);
 }
 
 /*
@@ -1589,7 +1602,7 @@ static struct ctl_table vs_vars[] = {
         { .ctl_name = 0 }
 };
 
-struct ctl_path net_vs_ctl_path[] = {
+const struct ctl_path net_vs_ctl_path[] = {
         { .procname = "net", .ctl_name = CTL_NET, },
         { .procname = "ipv4", .ctl_name = NET_IPV4, },
         { .procname = "vs", },
@@ -1784,7 +1797,9 @@ static const struct file_operations ip_vs_info_fops = {
 
 #endif
 
-struct ip_vs_stats ip_vs_stats;
+struct ip_vs_stats ip_vs_stats = {
+        .lock = __SPIN_LOCK_UNLOCKED(ip_vs_stats.lock),
+};
 
 #ifdef CONFIG_PROC_FS
 static int ip_vs_stats_show(struct seq_file *seq, void *v)
@@ -2306,7 +2321,7 @@ static struct nf_sockopt_ops ip_vs_sockopts = {
 };
 
 
-int ip_vs_control_init(void)
+int __init ip_vs_control_init(void)
 {
         int ret;
         int idx;
@@ -2333,8 +2348,6 @@ int ip_vs_control_init(void)
                 INIT_LIST_HEAD(&ip_vs_rtable[idx]);
         }
 
-        memset(&ip_vs_stats, 0, sizeof(ip_vs_stats));
-        spin_lock_init(&ip_vs_stats.lock);
         ip_vs_new_estimator(&ip_vs_stats);
 
         /* Hook the defense timer */
diff --git a/net/ipv4/ipvs/ip_vs_dh.c b/net/ipv4/ipvs/ip_vs_dh.c
index 8afc1503ed20..fa66824d264f 100644
--- a/net/ipv4/ipvs/ip_vs_dh.c
+++ b/net/ipv4/ipvs/ip_vs_dh.c
@@ -233,6 +233,7 @@ static struct ip_vs_scheduler ip_vs_dh_scheduler =
         .name =                 "dh",
         .refcnt =               ATOMIC_INIT(0),
         .module =               THIS_MODULE,
+        .n_list =               LIST_HEAD_INIT(ip_vs_dh_scheduler.n_list),
         .init_service =         ip_vs_dh_init_svc,
         .done_service =         ip_vs_dh_done_svc,
         .update_service =       ip_vs_dh_update_svc,
@@ -242,7 +243,6 @@ static struct ip_vs_scheduler ip_vs_dh_scheduler =
 
 static int __init ip_vs_dh_init(void)
 {
-        INIT_LIST_HEAD(&ip_vs_dh_scheduler.n_list);
         return register_ip_vs_scheduler(&ip_vs_dh_scheduler);
 }
 
diff --git a/net/ipv4/ipvs/ip_vs_est.c b/net/ipv4/ipvs/ip_vs_est.c
index bc04eedd6dbb..5a20f93bd7f9 100644
--- a/net/ipv4/ipvs/ip_vs_est.c
+++ b/net/ipv4/ipvs/ip_vs_est.c
@@ -17,6 +17,7 @@
 #include <linux/types.h>
 #include <linux/interrupt.h>
 #include <linux/sysctl.h>
+#include <linux/list.h>
 
 #include <net/ip_vs.h>
 
@@ -44,28 +45,11 @@
  */
 
 
-struct ip_vs_estimator
-{
-        struct ip_vs_estimator  *next;
-        struct ip_vs_stats      *stats;
-
-        u32                     last_conns;
-        u32                     last_inpkts;
-        u32                     last_outpkts;
-        u64                     last_inbytes;
-        u64                     last_outbytes;
-
-        u32                     cps;
-        u32                     inpps;
-        u32                     outpps;
-        u32                     inbps;
-        u32                     outbps;
-};
-
+static void estimation_timer(unsigned long arg);
 
-static struct ip_vs_estimator *est_list = NULL;
-static DEFINE_RWLOCK(est_lock);
-static struct timer_list est_timer;
+static LIST_HEAD(est_list);
+static DEFINE_SPINLOCK(est_lock);
+static DEFINE_TIMER(est_timer, estimation_timer, 0, 0);
 
 static void estimation_timer(unsigned long arg)
 {
@@ -76,9 +60,9 @@ static void estimation_timer(unsigned long arg)
         u64 n_inbytes, n_outbytes;
         u32 rate;
 
-        read_lock(&est_lock);
-        for (e = est_list; e; e = e->next) {
-                s = e->stats;
+        spin_lock(&est_lock);
+        list_for_each_entry(e, &est_list, list) {
+                s = container_of(e, struct ip_vs_stats, est);
 
                 spin_lock(&s->lock);
                 n_conns = s->conns;
@@ -114,19 +98,16 @@ static void estimation_timer(unsigned long arg)
                 s->outbps = (e->outbps+0xF)>>5;
                 spin_unlock(&s->lock);
         }
-        read_unlock(&est_lock);
+        spin_unlock(&est_lock);
         mod_timer(&est_timer, jiffies + 2*HZ);
 }
 
-int ip_vs_new_estimator(struct ip_vs_stats *stats)
+void ip_vs_new_estimator(struct ip_vs_stats *stats)
 {
-        struct ip_vs_estimator *est;
+        struct ip_vs_estimator *est = &stats->est;
 
-        est = kzalloc(sizeof(*est), GFP_KERNEL);
-        if (est == NULL)
-                return -ENOMEM;
+        INIT_LIST_HEAD(&est->list);
 
-        est->stats = stats;
         est->last_conns = stats->conns;
         est->cps = stats->cps<<10;
 
@@ -142,59 +123,40 @@ int ip_vs_new_estimator(struct ip_vs_stats *stats)
         est->last_outbytes = stats->outbytes;
         est->outbps = stats->outbps<<5;
 
-        write_lock_bh(&est_lock);
-        est->next = est_list;
-        if (est->next == NULL) {
-                setup_timer(&est_timer, estimation_timer, 0);
-                est_timer.expires = jiffies + 2*HZ;
-                add_timer(&est_timer);
-        }
-        est_list = est;
-        write_unlock_bh(&est_lock);
-        return 0;
+        spin_lock_bh(&est_lock);
+        if (list_empty(&est_list))
+                mod_timer(&est_timer, jiffies + 2 * HZ);
+        list_add(&est->list, &est_list);
+        spin_unlock_bh(&est_lock);
 }
 
 void ip_vs_kill_estimator(struct ip_vs_stats *stats)
 {
-        struct ip_vs_estimator *est, **pest;
-        int killed = 0;
-
-        write_lock_bh(&est_lock);
-        pest = &est_list;
-        while ((est=*pest) != NULL) {
-                if (est->stats != stats) {
-                        pest = &est->next;
-                        continue;
-                }
-                *pest = est->next;
-                kfree(est);
-                killed++;
+        struct ip_vs_estimator *est = &stats->est;
+
+        spin_lock_bh(&est_lock);
+        list_del(&est->list);
+        while (list_empty(&est_list) && try_to_del_timer_sync(&est_timer) < 0) {
+                spin_unlock_bh(&est_lock);
+                cpu_relax();
+                spin_lock_bh(&est_lock);
         }
-        if (killed && est_list == NULL)
-                del_timer_sync(&est_timer);
-        write_unlock_bh(&est_lock);
+        spin_unlock_bh(&est_lock);
 }
 
 void ip_vs_zero_estimator(struct ip_vs_stats *stats)
 {
-        struct ip_vs_estimator *e;
-
-        write_lock_bh(&est_lock);
-        for (e = est_list; e; e = e->next) {
-                if (e->stats != stats)
-                        continue;
-
-                /* set counters zero */
-                e->last_conns = 0;
-                e->last_inpkts = 0;
-                e->last_outpkts = 0;
-                e->last_inbytes = 0;
-                e->last_outbytes = 0;
-                e->cps = 0;
-                e->inpps = 0;
-                e->outpps = 0;
-                e->inbps = 0;
-                e->outbps = 0;
-        }
-        write_unlock_bh(&est_lock);
+        struct ip_vs_estimator *est = &stats->est;
+
+        /* set counters zero, caller must hold the stats->lock lock */
+        est->last_inbytes = 0;
+        est->last_outbytes = 0;
+        est->last_conns = 0;
+        est->last_inpkts = 0;
+        est->last_outpkts = 0;
+        est->cps = 0;
+        est->inpps = 0;
+        est->outpps = 0;
+        est->inbps = 0;
+        est->outbps = 0;
 }
diff --git a/net/ipv4/ipvs/ip_vs_lblc.c b/net/ipv4/ipvs/ip_vs_lblc.c
index 0efa3db4b180..7a6a319f544a 100644
--- a/net/ipv4/ipvs/ip_vs_lblc.c
+++ b/net/ipv4/ipvs/ip_vs_lblc.c
@@ -539,6 +539,7 @@ static struct ip_vs_scheduler ip_vs_lblc_scheduler =
         .name =                 "lblc",
         .refcnt =               ATOMIC_INIT(0),
         .module =               THIS_MODULE,
+        .n_list =               LIST_HEAD_INIT(ip_vs_lblc_scheduler.n_list),
         .init_service =         ip_vs_lblc_init_svc,
         .done_service =         ip_vs_lblc_done_svc,
         .update_service =       ip_vs_lblc_update_svc,
@@ -550,7 +551,6 @@ static int __init ip_vs_lblc_init(void)
 {
         int ret;
 
-        INIT_LIST_HEAD(&ip_vs_lblc_scheduler.n_list);
         sysctl_header = register_sysctl_paths(net_vs_ctl_path, vs_vars_table);
         ret = register_ip_vs_scheduler(&ip_vs_lblc_scheduler);
         if (ret)
diff --git a/net/ipv4/ipvs/ip_vs_lblcr.c b/net/ipv4/ipvs/ip_vs_lblcr.c
index 8e3bbeb45138..c234e73968a6 100644
--- a/net/ipv4/ipvs/ip_vs_lblcr.c
+++ b/net/ipv4/ipvs/ip_vs_lblcr.c
@@ -728,6 +728,7 @@ static struct ip_vs_scheduler ip_vs_lblcr_scheduler =
         .name =                 "lblcr",
         .refcnt =               ATOMIC_INIT(0),
         .module =               THIS_MODULE,
+        .n_list =               LIST_HEAD_INIT(ip_vs_lblcr_scheduler.n_list),
         .init_service =         ip_vs_lblcr_init_svc,
         .done_service =         ip_vs_lblcr_done_svc,
         .update_service =       ip_vs_lblcr_update_svc,
@@ -739,7 +740,6 @@ static int __init ip_vs_lblcr_init(void)
 {
         int ret;
 
-        INIT_LIST_HEAD(&ip_vs_lblcr_scheduler.n_list);
         sysctl_header = register_sysctl_paths(net_vs_ctl_path, vs_vars_table);
         ret = register_ip_vs_scheduler(&ip_vs_lblcr_scheduler);
         if (ret)
diff --git a/net/ipv4/ipvs/ip_vs_lc.c b/net/ipv4/ipvs/ip_vs_lc.c
index ac9f08e065d5..ebcdbf75ac65 100644
--- a/net/ipv4/ipvs/ip_vs_lc.c
+++ b/net/ipv4/ipvs/ip_vs_lc.c
@@ -98,6 +98,7 @@ static struct ip_vs_scheduler ip_vs_lc_scheduler = {
         .name =                 "lc",
         .refcnt =               ATOMIC_INIT(0),
         .module =               THIS_MODULE,
+        .n_list =               LIST_HEAD_INIT(ip_vs_lc_scheduler.n_list),
         .init_service =         ip_vs_lc_init_svc,
         .done_service =         ip_vs_lc_done_svc,
         .update_service =       ip_vs_lc_update_svc,
@@ -107,7 +108,6 @@ static struct ip_vs_scheduler ip_vs_lc_scheduler = {
 
 static int __init ip_vs_lc_init(void)
 {
-        INIT_LIST_HEAD(&ip_vs_lc_scheduler.n_list);
         return register_ip_vs_scheduler(&ip_vs_lc_scheduler) ;
 }
 
diff --git a/net/ipv4/ipvs/ip_vs_nq.c b/net/ipv4/ipvs/ip_vs_nq.c
index a46bf258d420..92f3a6770031 100644
--- a/net/ipv4/ipvs/ip_vs_nq.c
+++ b/net/ipv4/ipvs/ip_vs_nq.c
@@ -136,6 +136,7 @@ static struct ip_vs_scheduler ip_vs_nq_scheduler =
         .name =                 "nq",
         .refcnt =               ATOMIC_INIT(0),
         .module =               THIS_MODULE,
+        .n_list =               LIST_HEAD_INIT(ip_vs_nq_scheduler.n_list),
         .init_service =         ip_vs_nq_init_svc,
         .done_service =         ip_vs_nq_done_svc,
         .update_service =       ip_vs_nq_update_svc,
@@ -145,7 +146,6 @@ static struct ip_vs_scheduler ip_vs_nq_scheduler =
 
 static int __init ip_vs_nq_init(void)
 {
-        INIT_LIST_HEAD(&ip_vs_nq_scheduler.n_list);
         return register_ip_vs_scheduler(&ip_vs_nq_scheduler);
 }
 
diff --git a/net/ipv4/ipvs/ip_vs_proto.c b/net/ipv4/ipvs/ip_vs_proto.c
index 876714f23d65..6099a88fc200 100644
--- a/net/ipv4/ipvs/ip_vs_proto.c
+++ b/net/ipv4/ipvs/ip_vs_proto.c
@@ -43,7 +43,7 @@ static struct ip_vs_protocol *ip_vs_proto_table[IP_VS_PROTO_TAB_SIZE];
 /*
  *      register an ipvs protocol
  */
-static int __used register_ip_vs_protocol(struct ip_vs_protocol *pp)
+static int __used __init register_ip_vs_protocol(struct ip_vs_protocol *pp)
 {
         unsigned hash = IP_VS_PROTO_HASH(pp->protocol);
 
@@ -190,7 +190,7 @@ ip_vs_tcpudp_debug_packet(struct ip_vs_protocol *pp,
 }
 
 
-int ip_vs_protocol_init(void)
+int __init ip_vs_protocol_init(void)
 {
         char protocols[64];
 #define REGISTER_PROTOCOL(p)                    \
diff --git a/net/ipv4/ipvs/ip_vs_rr.c b/net/ipv4/ipvs/ip_vs_rr.c
index c8db12d39e61..358110d17e59 100644
--- a/net/ipv4/ipvs/ip_vs_rr.c
+++ b/net/ipv4/ipvs/ip_vs_rr.c
@@ -94,6 +94,7 @@ static struct ip_vs_scheduler ip_vs_rr_scheduler = {
         .name =                 "rr",                   /* name */
         .refcnt =               ATOMIC_INIT(0),
         .module =               THIS_MODULE,
+        .n_list =               LIST_HEAD_INIT(ip_vs_rr_scheduler.n_list),
         .init_service =         ip_vs_rr_init_svc,
         .done_service =         ip_vs_rr_done_svc,
         .update_service =       ip_vs_rr_update_svc,
@@ -102,7 +103,6 @@ static struct ip_vs_scheduler ip_vs_rr_scheduler = {
 
 static int __init ip_vs_rr_init(void)
 {
-        INIT_LIST_HEAD(&ip_vs_rr_scheduler.n_list);
         return register_ip_vs_scheduler(&ip_vs_rr_scheduler);
 }
 
diff --git a/net/ipv4/ipvs/ip_vs_sched.c b/net/ipv4/ipvs/ip_vs_sched.c
index b64767309855..a46ad9e35016 100644
--- a/net/ipv4/ipvs/ip_vs_sched.c
+++ b/net/ipv4/ipvs/ip_vs_sched.c
@@ -184,7 +184,7 @@ int register_ip_vs_scheduler(struct ip_vs_scheduler *scheduler)
 
         write_lock_bh(&__ip_vs_sched_lock);
 
-        if (scheduler->n_list.next != &scheduler->n_list) {
+        if (!list_empty(&scheduler->n_list)) {
                 write_unlock_bh(&__ip_vs_sched_lock);
                 ip_vs_use_count_dec();
                 IP_VS_ERR("register_ip_vs_scheduler(): [%s] scheduler "
@@ -229,7 +229,7 @@ int unregister_ip_vs_scheduler(struct ip_vs_scheduler *scheduler)
         }
 
         write_lock_bh(&__ip_vs_sched_lock);
-        if (scheduler->n_list.next == &scheduler->n_list) {
+        if (list_empty(&scheduler->n_list)) {
                 write_unlock_bh(&__ip_vs_sched_lock);
                 IP_VS_ERR("unregister_ip_vs_scheduler(): [%s] scheduler "
                           "is not in the list. failed\n", scheduler->name);
diff --git a/net/ipv4/ipvs/ip_vs_sed.c b/net/ipv4/ipvs/ip_vs_sed.c
index 2a7d31358181..77663d84cbd1 100644
--- a/net/ipv4/ipvs/ip_vs_sed.c
+++ b/net/ipv4/ipvs/ip_vs_sed.c
@@ -138,6 +138,7 @@ static struct ip_vs_scheduler ip_vs_sed_scheduler =
         .name =                 "sed",
         .refcnt =               ATOMIC_INIT(0),
         .module =               THIS_MODULE,
+        .n_list =               LIST_HEAD_INIT(ip_vs_sed_scheduler.n_list),
         .init_service =         ip_vs_sed_init_svc,
         .done_service =         ip_vs_sed_done_svc,
         .update_service =       ip_vs_sed_update_svc,
@@ -147,7 +148,6 @@ static struct ip_vs_scheduler ip_vs_sed_scheduler =
 
 static int __init ip_vs_sed_init(void)
 {
-        INIT_LIST_HEAD(&ip_vs_sed_scheduler.n_list);
         return register_ip_vs_scheduler(&ip_vs_sed_scheduler);
 }
 
diff --git a/net/ipv4/ipvs/ip_vs_sh.c b/net/ipv4/ipvs/ip_vs_sh.c
index b8fdfac65001..7b979e228056 100644
--- a/net/ipv4/ipvs/ip_vs_sh.c
+++ b/net/ipv4/ipvs/ip_vs_sh.c
@@ -230,6 +230,7 @@ static struct ip_vs_scheduler ip_vs_sh_scheduler =
         .name =                 "sh",
         .refcnt =               ATOMIC_INIT(0),
         .module =               THIS_MODULE,
+        .n_list  =              LIST_HEAD_INIT(ip_vs_sh_scheduler.n_list),
         .init_service =         ip_vs_sh_init_svc,
         .done_service =         ip_vs_sh_done_svc,
         .update_service =       ip_vs_sh_update_svc,
@@ -239,7 +240,6 @@ static struct ip_vs_scheduler ip_vs_sh_scheduler =
 
 static int __init ip_vs_sh_init(void)
 {
-        INIT_LIST_HEAD(&ip_vs_sh_scheduler.n_list);
         return register_ip_vs_scheduler(&ip_vs_sh_scheduler);
 }
 
diff --git a/net/ipv4/ipvs/ip_vs_sync.c b/net/ipv4/ipvs/ip_vs_sync.c
index 45e9bd96c286..a652da2c3200 100644
--- a/net/ipv4/ipvs/ip_vs_sync.c
+++ b/net/ipv4/ipvs/ip_vs_sync.c
@@ -904,9 +904,9 @@ int stop_sync_thread(int state)
                  * progress of stopping the master sync daemon.
                  */
 
-                spin_lock(&ip_vs_sync_lock);
+                spin_lock_bh(&ip_vs_sync_lock);
                 ip_vs_sync_state &= ~IP_VS_STATE_MASTER;
-                spin_unlock(&ip_vs_sync_lock);
+                spin_unlock_bh(&ip_vs_sync_lock);
                 kthread_stop(sync_master_thread);
                 sync_master_thread = NULL;
         } else if (state == IP_VS_STATE_BACKUP) {
diff --git a/net/ipv4/ipvs/ip_vs_wlc.c b/net/ipv4/ipvs/ip_vs_wlc.c
index 772c3cb4eca1..9b0ef86bb1f7 100644
--- a/net/ipv4/ipvs/ip_vs_wlc.c
+++ b/net/ipv4/ipvs/ip_vs_wlc.c
@@ -126,6 +126,7 @@ static struct ip_vs_scheduler ip_vs_wlc_scheduler =
         .name =                 "wlc",
         .refcnt =               ATOMIC_INIT(0),
         .module =               THIS_MODULE,
+        .n_list =               LIST_HEAD_INIT(ip_vs_wlc_scheduler.n_list),
         .init_service =         ip_vs_wlc_init_svc,
         .done_service =         ip_vs_wlc_done_svc,
         .update_service =       ip_vs_wlc_update_svc,
@@ -135,7 +136,6 @@ static struct ip_vs_scheduler ip_vs_wlc_scheduler =
 
 static int __init ip_vs_wlc_init(void)
 {
-        INIT_LIST_HEAD(&ip_vs_wlc_scheduler.n_list);
         return register_ip_vs_scheduler(&ip_vs_wlc_scheduler);
 }
 
diff --git a/net/ipv4/ipvs/ip_vs_wrr.c b/net/ipv4/ipvs/ip_vs_wrr.c
index 1d6932d7dc97..0d86a79b87b5 100644
--- a/net/ipv4/ipvs/ip_vs_wrr.c
+++ b/net/ipv4/ipvs/ip_vs_wrr.c
@@ -212,6 +212,7 @@ static struct ip_vs_scheduler ip_vs_wrr_scheduler = {
         .name =                 "wrr",
         .refcnt =               ATOMIC_INIT(0),
         .module =               THIS_MODULE,
+        .n_list =               LIST_HEAD_INIT(ip_vs_wrr_scheduler.n_list),
         .init_service =         ip_vs_wrr_init_svc,
         .done_service =         ip_vs_wrr_done_svc,
         .update_service =       ip_vs_wrr_update_svc,
@@ -220,7 +221,6 @@ static struct ip_vs_scheduler ip_vs_wrr_scheduler = {
 
 static int __init ip_vs_wrr_init(void)
 {
-        INIT_LIST_HEAD(&ip_vs_wrr_scheduler.n_list);
         return register_ip_vs_scheduler(&ip_vs_wrr_scheduler) ;
 }
 
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 383d17359d01..8e42fbbd5761 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -989,7 +989,9 @@ int udp_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
                     up->encap_rcv != NULL) {
                         int ret;
 
+                        bh_unlock_sock(sk);
                         ret = (*up->encap_rcv)(sk, skb);
+                        bh_lock_sock(sk);
                         if (ret <= 0) {
                                 UDP_INC_STATS_BH(sock_net(sk),
                                                  UDP_MIB_INDATAGRAMS,
@@ -1092,7 +1094,7 @@ static int __udp4_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
                         if (skb1) {
                                 int ret = 0;
 
-                                bh_lock_sock_nested(sk);
+                                bh_lock_sock(sk);
                                 if (!sock_owned_by_user(sk))
                                         ret = udp_queue_rcv_skb(sk, skb1);
                                 else
@@ -1194,7 +1196,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[],
 
         if (sk != NULL) {
                 int ret = 0;
-                bh_lock_sock_nested(sk);
+                bh_lock_sock(sk);
                 if (!sock_owned_by_user(sk))
                         ret = udp_queue_rcv_skb(sk, skb);
                 else
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 5a3e87e4b18f..41b165ffb369 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2187,8 +2187,9 @@ static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt,
 #endif
                         NLA_PUT_U32(skb, RTA_IIF, iif);
         } else if (dst) {
+                struct inet6_dev *idev = ip6_dst_idev(&rt->u.dst);
                 struct in6_addr saddr_buf;
-                if (ipv6_dev_get_saddr(ip6_dst_idev(&rt->u.dst)->dev,
+                if (ipv6_dev_get_saddr(idev ? idev->dev : NULL,
                                        dst, 0, &saddr_buf) == 0)
                         NLA_PUT(skb, RTA_PREFSRC, 16, &saddr_buf);
         }
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index d1477b350f76..a6aecf76a71b 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -379,7 +379,7 @@ static int __udp6_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
                                         uh->source, saddr, dif))) {
                 struct sk_buff *buff = skb_clone(skb, GFP_ATOMIC);
                 if (buff) {
-                        bh_lock_sock_nested(sk2);
+                        bh_lock_sock(sk2);
                         if (!sock_owned_by_user(sk2))
                                 udpv6_queue_rcv_skb(sk2, buff);
                         else
@@ -387,7 +387,7 @@ static int __udp6_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
                         bh_unlock_sock(sk2);
                 }
         }
-        bh_lock_sock_nested(sk);
+        bh_lock_sock(sk);
         if (!sock_owned_by_user(sk))
                 udpv6_queue_rcv_skb(sk, skb);
         else
@@ -508,7 +508,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[],
 
         /* deliver */
 
-        bh_lock_sock_nested(sk);
+        bh_lock_sock(sk);
         if (!sock_owned_by_user(sk))
                 udpv6_queue_rcv_skb(sk, skb);
         else
diff --git a/net/rxrpc/ar-accept.c b/net/rxrpc/ar-accept.c
index bdfb77417794..77228f28fa36 100644
--- a/net/rxrpc/ar-accept.c
+++ b/net/rxrpc/ar-accept.c
@@ -100,7 +100,7 @@ static int rxrpc_accept_incoming_call(struct rxrpc_local *local,
 
         trans = rxrpc_get_transport(local, peer, GFP_NOIO);
         rxrpc_put_peer(peer);
-        if (!trans) {
+        if (IS_ERR(trans)) {
                 _debug("no trans");
                 ret = -EBUSY;
                 goto error;
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index 26c7e1f9a350..9974b3f04f05 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -751,7 +751,7 @@ static int tca_action_flush(struct nlattr *nla, struct nlmsghdr *n, u32 pid)
         struct nlattr *tb[TCA_ACT_MAX+1];
         struct nlattr *kind;
         struct tc_action *a = create_a(0);
-        int err = -EINVAL;
+        int err = -ENOMEM;
 
         if (a == NULL) {
                 printk("tca_action_flush: couldnt create tc_action\n");
@@ -762,7 +762,7 @@ static int tca_action_flush(struct nlattr *nla, struct nlmsghdr *n, u32 pid)
         if (!skb) {
                 printk("tca_action_flush: failed skb alloc\n");
                 kfree(a);
-                return -ENOBUFS;
+                return err;
         }
 
         b = skb_tail_pointer(skb);
@@ -790,6 +790,8 @@ static int tca_action_flush(struct nlattr *nla, struct nlmsghdr *n, u32 pid)
         err = a->ops->walk(skb, &dcb, RTM_DELACTION, a);
         if (err < 0)
                 goto nla_put_failure;
+        if (err == 0)
+                goto noflush_out;
 
         nla_nest_end(skb, nest);
 
@@ -807,6 +809,7 @@ nla_put_failure:
 nlmsg_failure:
         module_put(a->ops->owner);
 err_out:
+noflush_out:
         kfree_skb(skb);
         kfree(a);
         return err;
@@ -824,8 +827,10 @@ tca_action_gd(struct nlattr *nla, struct nlmsghdr *n, u32 pid, int event)
                 return ret;
 
         if (event == RTM_DELACTION && n->nlmsg_flags&NLM_F_ROOT) {
-                if (tb[0] != NULL && tb[1] == NULL)
-                        return tca_action_flush(tb[0], n, pid);
+                if (tb[1] != NULL)
+                        return tca_action_flush(tb[1], n, pid);
+                else
+                        return -EINVAL;
         }
 
         for (i = 1; i <= TCA_ACT_MAX_PRIO && tb[i]; i++) {
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index ba1d121f3127..c25465e5607a 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -183,6 +183,21 @@ EXPORT_SYMBOL(unregister_qdisc);
    (root qdisc, all its children, children of children etc.)
  */
 
+struct Qdisc *qdisc_match_from_root(struct Qdisc *root, u32 handle)
+{
+        struct Qdisc *q;
+
+        if (!(root->flags & TCQ_F_BUILTIN) &&
+            root->handle == handle)
+                return root;
+
+        list_for_each_entry(q, &root->list, list) {
+                if (q->handle == handle)
+                        return q;
+        }
+        return NULL;
+}
+
 struct Qdisc *qdisc_lookup(struct net_device *dev, u32 handle)
 {
         unsigned int i;
@@ -191,16 +206,11 @@ struct Qdisc *qdisc_lookup(struct net_device *dev, u32 handle)
                 struct netdev_queue *txq = netdev_get_tx_queue(dev, i);
                 struct Qdisc *q, *txq_root = txq->qdisc_sleeping;
 
-                if (!(txq_root->flags & TCQ_F_BUILTIN) &&
-                    txq_root->handle == handle)
-                        return txq_root;
-
-                list_for_each_entry(q, &txq_root->list, list) {
-                        if (q->handle == handle)
-                                return q;
-                }
+                q = qdisc_match_from_root(txq_root, handle);
+                if (q)
+                        return q;
         }
-        return NULL;
+        return qdisc_match_from_root(dev->rx_queue.qdisc_sleeping, handle);
 }
 
 static struct Qdisc *qdisc_leaf(struct Qdisc *p, u32 classid)
@@ -321,7 +331,7 @@ static struct qdisc_size_table *qdisc_get_stab(struct nlattr *opt)
         if (!s || tsize != s->tsize || (!tab && tsize > 0))
                 return ERR_PTR(-EINVAL);
 
-        spin_lock(&qdisc_stab_lock);
+        spin_lock_bh(&qdisc_stab_lock);
 
         list_for_each_entry(stab, &qdisc_stab_list, list) {
                 if (memcmp(&stab->szopts, s, sizeof(*s)))
@@ -329,11 +339,11 @@ static struct qdisc_size_table *qdisc_get_stab(struct nlattr *opt)
                 if (tsize > 0 && memcmp(stab->data, tab, tsize * sizeof(u16)))
                         continue;
                 stab->refcnt++;
-                spin_unlock(&qdisc_stab_lock);
+                spin_unlock_bh(&qdisc_stab_lock);
                 return stab;
         }
 
-        spin_unlock(&qdisc_stab_lock);
+        spin_unlock_bh(&qdisc_stab_lock);
 
         stab = kmalloc(sizeof(*stab) + tsize * sizeof(u16), GFP_KERNEL);
         if (!stab)
@@ -344,9 +354,9 @@ static struct qdisc_size_table *qdisc_get_stab(struct nlattr *opt)
         if (tsize > 0)
                 memcpy(stab->data, tab, tsize * sizeof(u16));
 
-        spin_lock(&qdisc_stab_lock);
+        spin_lock_bh(&qdisc_stab_lock);
         list_add_tail(&stab->list, &qdisc_stab_list);
-        spin_unlock(&qdisc_stab_lock);
+        spin_unlock_bh(&qdisc_stab_lock);
 
         return stab;
 }
@@ -356,14 +366,14 @@ void qdisc_put_stab(struct qdisc_size_table *tab)
         if (!tab)
                 return;
 
-        spin_lock(&qdisc_stab_lock);
+        spin_lock_bh(&qdisc_stab_lock);
 
         if (--tab->refcnt == 0) {
                 list_del(&tab->list);
                 kfree(tab);
         }
 
-        spin_unlock(&qdisc_stab_lock);
+        spin_unlock_bh(&qdisc_stab_lock);
 }
 EXPORT_SYMBOL(qdisc_put_stab);
 
@@ -908,7 +918,7 @@ static int tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n, void *arg)
                                         return -ENOENT;
                                 q = qdisc_leaf(p, clid);
                         } else { /* ingress */
-                                q = dev->rx_queue.qdisc;
+                                q = dev->rx_queue.qdisc_sleeping;
                         }
                 } else {
                         struct netdev_queue *dev_queue;
@@ -978,7 +988,7 @@ replay:
                                         return -ENOENT;
                                 q = qdisc_leaf(p, clid);
                         } else { /*ingress */
-                                q = dev->rx_queue.qdisc;
+                                q = dev->rx_queue.qdisc_sleeping;
                         }
                 } else {
                         struct netdev_queue *dev_queue;
@@ -1529,11 +1539,11 @@ static int tc_dump_tclass(struct sk_buff *skb, struct netlink_callback *cb)
         t = 0;
 
         dev_queue = netdev_get_tx_queue(dev, 0);
-        if (tc_dump_tclass_root(dev_queue->qdisc, skb, tcm, cb, &t, s_t) < 0)
+        if (tc_dump_tclass_root(dev_queue->qdisc_sleeping, skb, tcm, cb, &t, s_t) < 0)
                 goto done;
 
         dev_queue = &dev->rx_queue;
-        if (tc_dump_tclass_root(dev_queue->qdisc, skb, tcm, cb, &t, s_t) < 0)
+        if (tc_dump_tclass_root(dev_queue->qdisc_sleeping, skb, tcm, cb, &t, s_t) < 0)
                 goto done;
 
 done:
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 7cf83b37459d..468574682caa 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -647,7 +647,7 @@ static void dev_deactivate_queue(struct net_device *dev,
         }
 }
 
-static bool some_qdisc_is_running(struct net_device *dev, int lock)
+static bool some_qdisc_is_busy(struct net_device *dev, int lock)
 {
         unsigned int i;
 
@@ -658,13 +658,14 @@ static bool some_qdisc_is_running(struct net_device *dev, int lock)
                 int val;
 
                 dev_queue = netdev_get_tx_queue(dev, i);
-                q = dev_queue->qdisc;
+                q = dev_queue->qdisc_sleeping;
                 root_lock = qdisc_lock(q);
 
                 if (lock)
                         spin_lock_bh(root_lock);
 
-                val = test_bit(__QDISC_STATE_RUNNING, &q->state);
+                val = (test_bit(__QDISC_STATE_RUNNING, &q->state) ||
+                       test_bit(__QDISC_STATE_SCHED, &q->state));
 
                 if (lock)
                         spin_unlock_bh(root_lock);
@@ -689,14 +690,14 @@ void dev_deactivate(struct net_device *dev)
 
         /* Wait for outstanding qdisc_run calls. */
         do {
-                while (some_qdisc_is_running(dev, 0))
+                while (some_qdisc_is_busy(dev, 0))
                         yield();
 
                 /*
                  * Double-check inside queue lock to ensure that all effects
                  * of the queue run are visible when we return.
                  */
-                running = some_qdisc_is_running(dev, 1);
+                running = some_qdisc_is_busy(dev, 1);
 
                 /*
                  * The running flag should never be set at this point because
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index be35422711a3..6febd245e62b 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -1279,7 +1279,8 @@ static int htb_delete(struct Qdisc *sch, unsigned long arg)
 
         /* delete from hash and active; remainder in destroy_class */
         qdisc_class_hash_remove(&q->clhash, &cl->common);
-        cl->parent->children--;
+        if (cl->parent)
+                cl->parent->children--;
 
         if (cl->prio_activity)
                 htb_deactivate(q, cl);
diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c
index 0326d3060bc7..0747d8a9232f 100644
--- a/net/tipc/subscr.c
+++ b/net/tipc/subscr.c
@@ -85,7 +85,7 @@ static struct top_srv topsrv = { 0 };
 
 static u32 htohl(u32 in, int swap)
 {
-        return swap ? (u32)___constant_swab32(in) : in;
+        return swap ? swab32(in) : in;
 }
 
 /**
diff --git a/net/wireless/wext.c b/net/wireless/wext.c
index df5b3886c36b..d98ffb75119a 100644
--- a/net/wireless/wext.c
+++ b/net/wireless/wext.c
@@ -1277,6 +1277,7 @@ static int rtnetlink_fill_iwinfo(struct sk_buff *skb, struct net_device *dev,
         r->ifi_flags = dev_get_flags(dev);
         r->ifi_change = 0;      /* Wireless changes don't affect those flags */
 
+        NLA_PUT_STRING(skb, IFLA_IFNAME, dev->name);
         /* Add the wireless events in the netlink packet */
         NLA_PUT(skb, IFLA_WIRELESS, event_len, event);
 
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index 3f964db908a7..ac25b4c0e982 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -112,16 +112,13 @@ error_nolock:
 int xfrm_output_resume(struct sk_buff *skb, int err)
 {
         while (likely((err = xfrm_output_one(skb, err)) == 0)) {
-                struct xfrm_state *x;
-
                 nf_reset(skb);
 
                 err = skb->dst->ops->local_out(skb);
                 if (unlikely(err != 1))
                         goto out;
 
-                x = skb->dst->xfrm;
-                if (!x)
+                if (!skb->dst->xfrm)
                         return dst_output(skb);
 
                 err = nf_hook(skb->dst->ops->family,