Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

Conflicts: drivers/net/tg3.c drivers/net/wireless/rt2x00/rt2x00dev.c net/mac80211/ieee80211_i.h
author: David S. Miller <davem@davemloft.net> 2008-06-10 05:22:26 -0400
committer: David S. Miller <davem@davemloft.net> 2008-06-10 05:22:26 -0400
commit: 65b53e4cc90e59936733b3b95b9451d2ca47528d (patch)
tree: 29932718192962671c48c3fd1ea017a6112459e8 /net
parent: 788c0a53164c05c5ccdb1472474372b72ba74644 (diff)
parent: 2e761e0532a784816e7e822dbaaece8c5d4be14d (diff)
59 files changed, 688 insertions, 504 deletions
diff --git a/net/ax25/ax25_subr.c b/net/ax25/ax25_subr.c
index d8f215733175..034aa10a5198 100644
--- a/net/ax25/ax25_subr.c
+++ b/net/ax25/ax25_subr.c
@@ -64,20 +64,15 @@ void ax25_frames_acked(ax25_cb *ax25, unsigned short nr)
 void ax25_requeue_frames(ax25_cb *ax25)
 {
-        struct sk_buff *skb, *skb_prev = NULL;
+        struct sk_buff *skb;
        /*
         * Requeue all the un-ack-ed frames on the output queue to be picked
         * up by ax25_kick called from the timer. This arrangement handles the
         * possibility of an empty output queue.
         */
-        while ((skb = skb_dequeue(&ax25->ack_queue)) != NULL) {
+        while ((skb = skb_dequeue_tail(&ax25->ack_queue)) != NULL)
-                if (skb_prev == NULL)
+                skb_queue_head(&ax25->write_queue, skb);
-                        skb_queue_head(&ax25->write_queue, skb);
-                else
-                        skb_append(skb_prev, skb, &ax25->write_queue);
-                skb_prev = skb;
-        }
 }
 /*
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index eb62558e9b09..0c2c93735e93 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -423,8 +423,8 @@ static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
                rfcomm_dlc_lock(d);
                d->state = BT_CLOSED;
-                rfcomm_dlc_unlock(d);
                d->state_change(d, err);
+                rfcomm_dlc_unlock(d);
                skb_queue_purge(&d->tx_queue);
                rfcomm_dlc_unlink(d);
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index c3f749abb2d0..c9191871c1e0 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -566,11 +566,22 @@ static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
        if (dlc->state == BT_CLOSED) {
                if (!dev->tty) {
                        if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
-                                if (rfcomm_dev_get(dev->id) == NULL)
+                                /* Drop DLC lock here to avoid deadlock
+                                 * 1. rfcomm_dev_get will take rfcomm_dev_lock
+                                 *    but in rfcomm_dev_add there's lock order:
+                                 *    rfcomm_dev_lock -> dlc lock
+                                 * 2. rfcomm_dev_put will deadlock if it's
+                                 *    the last reference
+                                 */
+                                rfcomm_dlc_unlock(dlc);
+                                if (rfcomm_dev_get(dev->id) == NULL) {
+                                        rfcomm_dlc_lock(dlc);
                                        return;
+                                }
                                rfcomm_dev_del(dev);
                                rfcomm_dev_put(dev);
+                                rfcomm_dlc_lock(dlc);
                        }
                } else
                        tty_hangup(dev->tty);
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 5d9d7130bd6e..65f01f71b3f3 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1714,7 +1714,8 @@ static int neightbl_fill_parms(struct sk_buff *skb, struct neigh_parms *parms)
        return nla_nest_end(skb, nest);
 nla_put_failure:
-        return nla_nest_cancel(skb, nest);
+        nla_nest_cancel(skb, nest);
+        return -EMSGSIZE;
 }
 static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
@@ -2057,9 +2058,9 @@ static int neigh_fill_info(struct sk_buff *skb, struct neighbour *neigh,
                goto nla_put_failure;
        }
-        ci.ndm_used      = now - neigh->used;
+        ci.ndm_used      = jiffies_to_clock_t(now - neigh->used);
-        ci.ndm_confirmed = now - neigh->confirmed;
+        ci.ndm_confirmed = jiffies_to_clock_t(now - neigh->confirmed);
-        ci.ndm_updated   = now - neigh->updated;
+        ci.ndm_updated   = jiffies_to_clock_t(now - neigh->updated);
        ci.ndm_refcnt    = atomic_read(&neigh->refcnt) - 1;
        read_unlock_bh(&neigh->lock);
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index ca32ddb8ad17..6c8d7f0ea01a 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -498,7 +498,8 @@ int rtnetlink_put_metrics(struct sk_buff *skb, u32 *metrics)
        return nla_nest_end(skb, mx);
 nla_put_failure:
-        return nla_nest_cancel(skb, mx);
+        nla_nest_cancel(skb, mx);
+        return -EMSGSIZE;
 }
 int rtnl_put_cacheinfo(struct sk_buff *skb, struct dst_entry *dst, u32 id,
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 5c459f2b7985..1e556d312117 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -1445,6 +1445,7 @@ done:
        if (spd.nr_pages) {
                int ret;
+                struct sock *sk = __skb->sk;
                /*
                 * Drop the socket lock, otherwise we have reverse
@@ -1455,9 +1456,9 @@ done:
                 * we call into ->sendpage() with the i_mutex lock held
                 * and networking will grab the socket lock.
                 */
-                release_sock(__skb->sk);
+                release_sock(sk);
                ret = splice_to_pipe(pipe, &spd);
-                lock_sock(__skb->sk);
+                lock_sock(sk);
                return ret;
        }
diff --git a/net/core/user_dma.c b/net/core/user_dma.c
index 0ad1cd57bc39..c77aff9c6eb3 100644
--- a/net/core/user_dma.c
+++ b/net/core/user_dma.c
@@ -75,7 +75,7 @@ int dma_skb_copy_datagram_iovec(struct dma_chan *chan,
                end = start + skb_shinfo(skb)->frags[i].size;
                copy = end - offset;
-                if ((copy = end - offset) > 0) {
+                if (copy > 0) {
                        skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
                        struct page *page = frag->page;
diff --git a/net/dccp/ccids/ccid3.c b/net/dccp/ccids/ccid3.c
index cd61dea2eea1..f813077234b7 100644
--- a/net/dccp/ccids/ccid3.c
+++ b/net/dccp/ccids/ccid3.c
@@ -193,22 +193,17 @@ static inline void ccid3_hc_tx_update_s(struct ccid3_hc_tx_sock *hctx, int len)
 /*
 *      Update Window Counter using the algorithm from [RFC 4342, 8.1].
- *      The algorithm is not applicable if RTT < 4 microseconds.
+ *      As elsewhere, RTT > 0 is assumed by using dccp_sample_rtt().
 */
 static inline void ccid3_hc_tx_update_win_count(struct ccid3_hc_tx_sock *hctx,
                                                ktime_t now)
 {
-        u32 quarter_rtts;
+        u32 delta = ktime_us_delta(now, hctx->ccid3hctx_t_last_win_count),
+            quarter_rtts = (4 * delta) / hctx->ccid3hctx_rtt;
-        if (unlikely(hctx->ccid3hctx_rtt < 4))  /* avoid divide-by-zero */
-                return;
-        quarter_rtts = ktime_us_delta(now, hctx->ccid3hctx_t_last_win_count);
-        quarter_rtts /= hctx->ccid3hctx_rtt / 4;
        if (quarter_rtts > 0) {
                hctx->ccid3hctx_t_last_win_count = now;
-                hctx->ccid3hctx_last_win_count  += min_t(u32, quarter_rtts, 5);
+                hctx->ccid3hctx_last_win_count  += min(quarter_rtts, 5U);
                hctx->ccid3hctx_last_win_count  &= 0xF;         /* mod 16 */
        }
 }
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index b348dd70c685..c22a3780c14e 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -739,8 +739,8 @@ int dccp_invalid_packet(struct sk_buff *skb)
         * If P.type is not Data, Ack, or DataAck and P.X == 0 (the packet
         * has short sequence numbers), drop packet and return
         */
-        if (dh->dccph_type >= DCCP_PKT_DATA    &&
+        if ((dh->dccph_type < DCCP_PKT_DATA    ||
-            dh->dccph_type <= DCCP_PKT_DATAACK && dh->dccph_x == 0)  {
+            dh->dccph_type > DCCP_PKT_DATAACK) && dh->dccph_x == 0)  {
                DCCP_WARN("P.type (%s) not Data || [Data]Ack, while P.X == 0\n",
                          dccp_packet_name(dh->dccph_type));
                return 1;
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 6848e4760f34..79a7ef6209ff 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -90,7 +90,6 @@ static const struct nla_policy ifa_ipv4_policy[IFA_MAX+1] = {
        [IFA_LOCAL]             = { .type = NLA_U32 },
        [IFA_ADDRESS]           = { .type = NLA_U32 },
        [IFA_BROADCAST]         = { .type = NLA_U32 },
-        [IFA_ANYCAST]           = { .type = NLA_U32 },
        [IFA_LABEL]             = { .type = NLA_STRING, .len = IFNAMSIZ - 1 },
 };
@@ -536,9 +535,6 @@ static struct in_ifaddr *rtm_to_ifaddr(struct net *net, struct nlmsghdr *nlh)
        if (tb[IFA_BROADCAST])
                ifa->ifa_broadcast = nla_get_be32(tb[IFA_BROADCAST]);
-        if (tb[IFA_ANYCAST])
-                ifa->ifa_anycast = nla_get_be32(tb[IFA_ANYCAST]);
        if (tb[IFA_LABEL])
                nla_strlcpy(ifa->ifa_label, tb[IFA_LABEL], IFNAMSIZ);
        else
@@ -745,7 +741,6 @@ int devinet_ioctl(struct net *net, unsigned int cmd, void __user *arg)
                                break;
                        inet_del_ifa(in_dev, ifap, 0);
                        ifa->ifa_broadcast = 0;
-                        ifa->ifa_anycast = 0;
                        ifa->ifa_scope = 0;
                }
@@ -1113,7 +1108,6 @@ static inline size_t inet_nlmsg_size(void)
               + nla_total_size(4) /* IFA_ADDRESS */
               + nla_total_size(4) /* IFA_LOCAL */
               + nla_total_size(4) /* IFA_BROADCAST */
-               + nla_total_size(4) /* IFA_ANYCAST */
               + nla_total_size(IFNAMSIZ); /* IFA_LABEL */
 }
@@ -1143,9 +1137,6 @@ static int inet_fill_ifaddr(struct sk_buff *skb, struct in_ifaddr *ifa,
        if (ifa->ifa_broadcast)
                NLA_PUT_BE32(skb, IFA_BROADCAST, ifa->ifa_broadcast);
-        if (ifa->ifa_anycast)
-                NLA_PUT_BE32(skb, IFA_ANYCAST, ifa->ifa_anycast);
        if (ifa->ifa_label[0])
                NLA_PUT_STRING(skb, IFA_LABEL, ifa->ifa_label);
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 0f1557a4ac7a..0b2ac6a3d903 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -506,7 +506,6 @@ const struct nla_policy rtm_ipv4_policy[RTA_MAX+1] = {
        [RTA_PREFSRC]           = { .type = NLA_U32 },
        [RTA_METRICS]           = { .type = NLA_NESTED },
        [RTA_MULTIPATH]         = { .len = sizeof(struct rtnexthop) },
-        [RTA_PROTOINFO]         = { .type = NLA_U32 },
        [RTA_FLOW]              = { .type = NLA_U32 },
 };
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index fead049daf43..e7e091d365ff 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -608,6 +608,14 @@ static void raw_close(struct sock *sk, long timeout)
        sk_common_release(sk);
 }
+static int raw_destroy(struct sock *sk)
+{
+        lock_sock(sk);
+        ip_flush_pending_frames(sk);
+        release_sock(sk);
+        return 0;
+}
 /* This gets rid of all the nasties in af_inet. -DaveM */
 static int raw_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 {
@@ -820,6 +828,7 @@ struct proto raw_prot = {
        .name              = "RAW",
        .owner             = THIS_MODULE,
        .close             = raw_close,
+        .destroy           = raw_destroy,
        .connect           = ip4_datagram_connect,
        .disconnect        = udp_disconnect,
        .ioctl             = raw_ioctl,
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index df41026b60db..96be336064fb 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1792,7 +1792,7 @@ static int __mkroute_input(struct sk_buff *skb,
        if (err)
                flags |= RTCF_DIRECTSRC;
-        if (out_dev == in_dev && err && !(flags & RTCF_MASQ) &&
+        if (out_dev == in_dev && err &&
            (IN_DEV_SHARED_MEDIA(out_dev) ||
             inet_addr_onlink(out_dev, saddr, FIB_RES_GW(*res))))
                flags |= RTCF_DOREDIRECT;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index f88653138621..ab66683b8043 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1227,7 +1227,14 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc,
                                copied += used;
                                offset += used;
                        }
-                        if (offset != skb->len)
+                        /*
+                         * If recv_actor drops the lock (e.g. TCP splice
+                         * receive) the skb pointer might be invalid when
+                         * getting here: tcp_collapse might have deleted it
+                         * while aggregating skbs from the socket queue.
+                         */
+                        skb = tcp_recv_skb(sk, seq-1, &offset);
+                        if (!skb || (offset+1 != skb->len))
                                break;
                }
                if (tcp_hdr(skb)->fin) {
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index b54d9d37b636..eba873e9b560 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1392,9 +1392,9 @@ static struct sk_buff *tcp_maybe_skipping_dsack(struct sk_buff *skb,
        if (before(next_dup->start_seq, skip_to_seq)) {
                skb = tcp_sacktag_skip(skb, sk, next_dup->start_seq, fack_count);
-                tcp_sacktag_walk(skb, sk, NULL,
+                skb = tcp_sacktag_walk(skb, sk, NULL,
-                                 next_dup->start_seq, next_dup->end_seq,
+                                     next_dup->start_seq, next_dup->end_seq,
-                                 1, fack_count, reord, flag);
+                                     1, fack_count, reord, flag);
        }
        return skb;
@@ -2483,6 +2483,20 @@ static inline void tcp_complete_cwr(struct sock *sk)
        tcp_ca_event(sk, CA_EVENT_COMPLETE_CWR);
 }
+static void tcp_try_keep_open(struct sock *sk)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+        int state = TCP_CA_Open;
+        if (tcp_left_out(tp) || tp->retrans_out || tp->undo_marker)
+                state = TCP_CA_Disorder;
+        if (inet_csk(sk)->icsk_ca_state != state) {
+                tcp_set_ca_state(sk, state);
+                tp->high_seq = tp->snd_nxt;
+        }
+}
 static void tcp_try_to_open(struct sock *sk, int flag)
 {
        struct tcp_sock *tp = tcp_sk(sk);
@@ -2496,15 +2510,7 @@ static void tcp_try_to_open(struct sock *sk, int flag)
                tcp_enter_cwr(sk, 1);
        if (inet_csk(sk)->icsk_ca_state != TCP_CA_CWR) {
-                int state = TCP_CA_Open;
+                tcp_try_keep_open(sk);
-                if (tcp_left_out(tp) || tp->retrans_out || tp->undo_marker)
-                        state = TCP_CA_Disorder;
-                if (inet_csk(sk)->icsk_ca_state != state) {
-                        tcp_set_ca_state(sk, state);
-                        tp->high_seq = tp->snd_nxt;
-                }
                tcp_moderate_cwnd(tp);
        } else {
                tcp_cwnd_down(sk, flag);
@@ -3310,8 +3316,11 @@ no_queue:
        return 1;
 old_ack:
-        if (TCP_SKB_CB(skb)->sacked)
+        if (TCP_SKB_CB(skb)->sacked) {
                tcp_sacktag_write_queue(sk, skb, prior_snd_una);
+                if (icsk->icsk_ca_state == TCP_CA_Open)
+                        tcp_try_keep_open(sk);
+        }
 uninteresting_ack:
        SOCK_DEBUG(sk, "Ack %u out of %u:%u\n", ack, tp->snd_una, tp->snd_nxt);
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index e399bde7813a..ad993ecb4810 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2131,6 +2131,8 @@ void tcp_send_active_reset(struct sock *sk, gfp_t priority)
        TCP_SKB_CB(skb)->when = tcp_time_stamp;
        if (tcp_transmit_skb(sk, skb, 0, priority))
                NET_INC_STATS(LINUX_MIB_TCPABORTFAILED);
+        TCP_INC_STATS(TCP_MIB_OUTRSTS);
 }
 /* WARNING: This routine must only be called when we have already sent
diff --git a/net/ipv4/tunnel4.c b/net/ipv4/tunnel4.c
index d3b709a6f264..cb1f0e83830b 100644
--- a/net/ipv4/tunnel4.c
+++ b/net/ipv4/tunnel4.c
@@ -97,7 +97,7 @@ static int tunnel64_rcv(struct sk_buff *skb)
 {
        struct xfrm_tunnel *handler;
-        if (!pskb_may_pull(skb, sizeof(struct iphdr)))
+        if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
                goto drop;
        for (handler = tunnel64_handlers; handler; handler = handler->next)
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index db1cb7c96d63..56fcda3694ba 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -420,7 +420,7 @@ void udp_err(struct sk_buff *skb, u32 info)
 /*
 * Throw away all pending data and cancel the corking. Socket is locked.
 */
-static void udp_flush_pending_frames(struct sock *sk)
+void udp_flush_pending_frames(struct sock *sk)
 {
        struct udp_sock *up = udp_sk(sk);
@@ -430,6 +430,7 @@ static void udp_flush_pending_frames(struct sock *sk)
                ip_flush_pending_frames(sk);
        }
 }
+EXPORT_SYMBOL(udp_flush_pending_frames);
 /**
 *      udp4_hwcsum_outgoing  -  handle outgoing HW checksumming
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 3a835578fd1c..147588f4c7c0 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -731,8 +731,13 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
                                                onlink = -1;
                                        spin_lock(&ifa->lock);
-                                        lifetime = min_t(unsigned long,
-                                                         ifa->valid_lft, 0x7fffffffUL/HZ);
+                                        lifetime = addrconf_timeout_fixup(ifa->valid_lft, HZ);
+                                        /*
+                                         * Note: Because this address is
+                                         * not permanent, lifetime <
+                                         * LONG_MAX / HZ here.
+                                         */
                                        if (time_before(expires,
                                                        ifa->tstamp + lifetime * HZ))
                                                expires = ifa->tstamp + lifetime * HZ;
@@ -1722,7 +1727,6 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len)
        __u32 valid_lft;
        __u32 prefered_lft;
        int addr_type;
-        unsigned long rt_expires;
        struct inet6_dev *in6_dev;
        pinfo = (struct prefix_info *) opt;
@@ -1764,28 +1768,23 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len)
         *      2) Configure prefixes with the auto flag set
         */
-        if (valid_lft == INFINITY_LIFE_TIME)
+        if (pinfo->onlink) {
-                rt_expires = ~0UL;
+                struct rt6_info *rt;
-        else if (valid_lft >= 0x7FFFFFFF/HZ) {
+                unsigned long rt_expires;
                /* Avoid arithmetic overflow. Really, we could
                 * save rt_expires in seconds, likely valid_lft,
                 * but it would require division in fib gc, that it
                 * not good.
                 */
-                rt_expires = 0x7FFFFFFF - (0x7FFFFFFF % HZ);
+                if (HZ > USER_HZ)
-        } else
+                        rt_expires = addrconf_timeout_fixup(valid_lft, HZ);
-                rt_expires = valid_lft * HZ;
+                else
+                        rt_expires = addrconf_timeout_fixup(valid_lft, USER_HZ);
-        /*
+                if (addrconf_finite_timeout(rt_expires))
-         * We convert this (in jiffies) to clock_t later.
+                        rt_expires *= HZ;
-         * Avoid arithmetic overflow there as well.
-         * Overflow can happen only if HZ < USER_HZ.
-         */
-        if (HZ < USER_HZ && ~rt_expires && rt_expires > 0x7FFFFFFF / USER_HZ)
-                rt_expires = 0x7FFFFFFF / USER_HZ;
-        if (pinfo->onlink) {
-                struct rt6_info *rt;
                rt = rt6_lookup(dev_net(dev), &pinfo->prefix, NULL,
                                dev->ifindex, 1);
@@ -1794,7 +1793,7 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len)
                        if (valid_lft == 0) {
                                ip6_del_rt(rt);
                                rt = NULL;
-                        } else if (~rt_expires) {
+                        } else if (addrconf_finite_timeout(rt_expires)) {
                                /* not infinity */
                                rt->rt6i_expires = jiffies + rt_expires;
                                rt->rt6i_flags |= RTF_EXPIRES;
@@ -1803,9 +1802,9 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len)
                                rt->rt6i_expires = 0;
                        }
                } else if (valid_lft) {
-                        int flags = RTF_ADDRCONF | RTF_PREFIX_RT;
                        clock_t expires = 0;
-                        if (~rt_expires) {
+                        int flags = RTF_ADDRCONF | RTF_PREFIX_RT;
+                        if (addrconf_finite_timeout(rt_expires)) {
                                /* not infinity */
                                flags |= RTF_EXPIRES;
                                expires = jiffies_to_clock_t(rt_expires);
@@ -2027,7 +2026,7 @@ err_exit:
 *      Manual configuration of address on an interface
 */
 static int inet6_addr_add(struct net *net, int ifindex, struct in6_addr *pfx,
-                          int plen, __u8 ifa_flags, __u32 prefered_lft,
+                          unsigned int plen, __u8 ifa_flags, __u32 prefered_lft,
                          __u32 valid_lft)
 {
        struct inet6_ifaddr *ifp;
@@ -2036,9 +2035,13 @@ static int inet6_addr_add(struct net *net, int ifindex, struct in6_addr *pfx,
        int scope;
        u32 flags;
        clock_t expires;
+        unsigned long timeout;
        ASSERT_RTNL();
+        if (plen > 128)
+                return -EINVAL;
        /* check the lifetime */
        if (!valid_lft || prefered_lft > valid_lft)
                return -EINVAL;
@@ -2052,22 +2055,23 @@ static int inet6_addr_add(struct net *net, int ifindex, struct in6_addr *pfx,
        scope = ipv6_addr_scope(pfx);
-        if (valid_lft == INFINITY_LIFE_TIME) {
+        timeout = addrconf_timeout_fixup(valid_lft, HZ);
-                ifa_flags |= IFA_F_PERMANENT;
+        if (addrconf_finite_timeout(timeout)) {
-                flags = 0;
+                expires = jiffies_to_clock_t(timeout * HZ);
-                expires = 0;
+                valid_lft = timeout;
-        } else {
-                if (valid_lft >= 0x7FFFFFFF/HZ)
-                        valid_lft = 0x7FFFFFFF/HZ;
                flags = RTF_EXPIRES;
-                expires = jiffies_to_clock_t(valid_lft * HZ);
+        } else {
+                expires = 0;
+                flags = 0;
+                ifa_flags |= IFA_F_PERMANENT;
        }
-        if (prefered_lft == 0)
+        timeout = addrconf_timeout_fixup(prefered_lft, HZ);
-                ifa_flags |= IFA_F_DEPRECATED;
+        if (addrconf_finite_timeout(timeout)) {
-        else if ((prefered_lft >= 0x7FFFFFFF/HZ) &&
+                if (timeout == 0)
-                 (prefered_lft != INFINITY_LIFE_TIME))
+                        ifa_flags |= IFA_F_DEPRECATED;
-                prefered_lft = 0x7FFFFFFF/HZ;
+                prefered_lft = timeout;
+        }
        ifp = ipv6_add_addr(idev, pfx, plen, scope, ifa_flags);
@@ -2095,12 +2099,15 @@ static int inet6_addr_add(struct net *net, int ifindex, struct in6_addr *pfx,
 }
 static int inet6_addr_del(struct net *net, int ifindex, struct in6_addr *pfx,
-                          int plen)
+                          unsigned int plen)
 {
        struct inet6_ifaddr *ifp;
        struct inet6_dev *idev;
        struct net_device *dev;
+        if (plen > 128)
+                return -EINVAL;
        dev = __dev_get_by_index(net, ifindex);
        if (!dev)
                return -ENODEV;
@@ -3169,26 +3176,28 @@ static int inet6_addr_modify(struct inet6_ifaddr *ifp, u8 ifa_flags,
 {
        u32 flags;
        clock_t expires;
+        unsigned long timeout;
        if (!valid_lft || (prefered_lft > valid_lft))
                return -EINVAL;
-        if (valid_lft == INFINITY_LIFE_TIME) {
+        timeout = addrconf_timeout_fixup(valid_lft, HZ);
-                ifa_flags |= IFA_F_PERMANENT;
+        if (addrconf_finite_timeout(timeout)) {
-                flags = 0;
+                expires = jiffies_to_clock_t(timeout * HZ);
-                expires = 0;
+                valid_lft = timeout;
-        } else {
-                if (valid_lft >= 0x7FFFFFFF/HZ)
-                        valid_lft = 0x7FFFFFFF/HZ;
                flags = RTF_EXPIRES;
-                expires = jiffies_to_clock_t(valid_lft * HZ);
+        } else {
+                expires = 0;
+                flags = 0;
+                ifa_flags |= IFA_F_PERMANENT;
        }
-        if (prefered_lft == 0)
+        timeout = addrconf_timeout_fixup(prefered_lft, HZ);
-                ifa_flags |= IFA_F_DEPRECATED;
+        if (addrconf_finite_timeout(timeout)) {
-        else if ((prefered_lft >= 0x7FFFFFFF/HZ) &&
+                if (timeout == 0)
-                 (prefered_lft != INFINITY_LIFE_TIME))
+                        ifa_flags |= IFA_F_DEPRECATED;
-                prefered_lft = 0x7FFFFFFF/HZ;
+                prefered_lft = timeout;
+        }
        spin_lock_bh(&ifp->lock);
        ifp->flags = (ifp->flags & ~(IFA_F_DEPRECATED | IFA_F_PERMANENT | IFA_F_NODAD | IFA_F_HOMEADDRESS)) | ifa_flags;
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 3c6aafb02183..e84b3fd17fb4 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -191,7 +191,7 @@ lookup_protocol:
        np->mcast_hops  = -1;
        np->mc_loop     = 1;
        np->pmtudisc    = IPV6_PMTUDISC_WANT;
-        np->ipv6only    = init_net.ipv6.sysctl.bindv6only;
+        np->ipv6only    = net->ipv6.sysctl.bindv6only;
        /* Init the ipv4 part of the socket since we can have sockets
         * using v6 API for ipv4.
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 94fa6ae77cfe..b9c2de84a8a2 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -496,7 +496,8 @@ int datagram_recv_ctl(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
        return 0;
 }
-int datagram_send_ctl(struct msghdr *msg, struct flowi *fl,
+int datagram_send_ctl(struct net *net,
+                      struct msghdr *msg, struct flowi *fl,
                      struct ipv6_txoptions *opt,
                      int *hlimit, int *tclass)
 {
@@ -509,7 +510,6 @@ int datagram_send_ctl(struct msghdr *msg, struct flowi *fl,
        for (cmsg = CMSG_FIRSTHDR(msg); cmsg; cmsg = CMSG_NXTHDR(msg, cmsg)) {
                int addr_type;
-                struct net_device *dev = NULL;
                if (!CMSG_OK(msg, cmsg)) {
                        err = -EINVAL;
@@ -522,6 +522,9 @@ int datagram_send_ctl(struct msghdr *msg, struct flowi *fl,
                switch (cmsg->cmsg_type) {
                case IPV6_PKTINFO:
                case IPV6_2292PKTINFO:
+                    {
+                        struct net_device *dev = NULL;
                        if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct in6_pktinfo))) {
                                err = -EINVAL;
                                goto exit_f;
@@ -535,32 +538,32 @@ int datagram_send_ctl(struct msghdr *msg, struct flowi *fl,
                                fl->oif = src_info->ipi6_ifindex;
                        }
-                        addr_type = ipv6_addr_type(&src_info->ipi6_addr);
+                        addr_type = __ipv6_addr_type(&src_info->ipi6_addr);
-                        if (addr_type == IPV6_ADDR_ANY)
+                        if (fl->oif) {
-                                break;
+                                dev = dev_get_by_index(net, fl->oif);
+                                if (!dev)
+                                        return -ENODEV;
+                        } else if (addr_type & IPV6_ADDR_LINKLOCAL)
+                                return -EINVAL;
-                        if (addr_type & IPV6_ADDR_LINKLOCAL) {
+                        if (addr_type != IPV6_ADDR_ANY) {
-                                if (!src_info->ipi6_ifindex)
+                                int strict = __ipv6_addr_src_scope(addr_type) <= IPV6_ADDR_SCOPE_LINKLOCAL;
-                                        return -EINVAL;
+                                if (!ipv6_chk_addr(net, &src_info->ipi6_addr,
-                                else {
+                                                   strict ? dev : NULL, 0))
-                                        dev = dev_get_by_index(&init_net, src_info->ipi6_ifindex);
+                                        err = -EINVAL;
-                                        if (!dev)
+                                else
-                                                return -ENODEV;
+                                        ipv6_addr_copy(&fl->fl6_src, &src_info->ipi6_addr);
-                                }
-                        }
-                        if (!ipv6_chk_addr(&init_net, &src_info->ipi6_addr,
-                                           dev, 0)) {
-                                if (dev)
-                                        dev_put(dev);
-                                err = -EINVAL;
-                                goto exit_f;
                        }
                        if (dev)
                                dev_put(dev);
-                        ipv6_addr_copy(&fl->fl6_src, &src_info->ipi6_addr);
+                        if (err)
+                                goto exit_f;
                        break;
+                    }
                case IPV6_FLOWINFO:
                        if (cmsg->cmsg_len < CMSG_LEN(4)) {
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index eb7a940310f4..37a4e777e347 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -354,7 +354,7 @@ fl_create(struct net *net, struct in6_flowlabel_req *freq, char __user *optval,
                msg.msg_control = (void*)(fl->opt+1);
                flowi.oif = 0;
-                err = datagram_send_ctl(&msg, &flowi, fl->opt, &junk, &junk);
+                err = datagram_send_ctl(net, &msg, &flowi, fl->opt, &junk, &junk);
                if (err)
                        goto done;
                err = -EINVAL;
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 56d55fecf8ec..26b83e512a09 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -161,9 +161,17 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                        struct ipv6_txoptions *opt;
                        struct sk_buff *pktopt;
-                        if (sk->sk_protocol != IPPROTO_UDP &&
+                        if (sk->sk_type == SOCK_RAW)
-                            sk->sk_protocol != IPPROTO_UDPLITE &&
+                                break;
-                            sk->sk_protocol != IPPROTO_TCP)
+                        if (sk->sk_protocol == IPPROTO_UDP ||
+                            sk->sk_protocol == IPPROTO_UDPLITE) {
+                                struct udp_sock *up = udp_sk(sk);
+                                if (up->pending == AF_INET6) {
+                                        retv = -EBUSY;
+                                        break;
+                                }
+                        } else if (sk->sk_protocol != IPPROTO_TCP)
                                break;
                        if (sk->sk_state != TCP_ESTABLISHED) {
@@ -416,7 +424,7 @@ sticky_done:
                msg.msg_controllen = optlen;
                msg.msg_control = (void*)(opt+1);
-                retv = datagram_send_ctl(&msg, &fl, opt, &junk, &junk);
+                retv = datagram_send_ctl(net, &msg, &fl, opt, &junk, &junk);
                if (retv)
                        goto done;
 update:
@@ -832,7 +840,7 @@ static int ipv6_getsockopt_sticky(struct sock *sk, struct ipv6_txoptions *opt,
        len = min_t(unsigned int, len, ipv6_optlen(hdr));
        if (copy_to_user(optval, hdr, len))
                return -EFAULT;
-        return ipv6_optlen(hdr);
+        return len;
 }
 static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
@@ -975,6 +983,9 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
                len = ipv6_getsockopt_sticky(sk, np->opt,
                                             optname, optval, len);
                release_sock(sk);
+                /* check if ipv6_getsockopt_sticky() returns err code */
+                if (len < 0)
+                        return len;
                return put_user(len, optlen);
        }
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 2dccad48058c..e65e26e210ee 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -209,7 +209,9 @@ fq_find(__be32 id, struct in6_addr *src, struct in6_addr *dst)
        arg.dst = dst;
        hash = ip6qhashfn(id, src, dst);
+        local_bh_disable();
        q = inet_frag_find(&nf_init_frags, &nf_frags, &arg, hash);
+        local_bh_enable();
        if (q == NULL)
                goto oom;
@@ -638,10 +640,10 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb)
                goto ret_orig;
        }
-        spin_lock(&fq->q.lock);
+        spin_lock_bh(&fq->q.lock);
        if (nf_ct_frag6_queue(fq, clone, fhdr, nhoff) < 0) {
-                spin_unlock(&fq->q.lock);
+                spin_unlock_bh(&fq->q.lock);
                pr_debug("Can't insert skb to queue\n");
                fq_put(fq);
                goto ret_orig;
@@ -653,7 +655,7 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb)
                if (ret_skb == NULL)
                        pr_debug("Can't reassemble fragmented packets\n");
        }
-        spin_unlock(&fq->q.lock);
+        spin_unlock_bh(&fq->q.lock);
        fq_put(fq);
        return ret_skb;
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 232e0dc45bf5..8fee9a15b2d3 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -813,7 +813,7 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                memset(opt, 0, sizeof(struct ipv6_txoptions));
                opt->tot_len = sizeof(struct ipv6_txoptions);
-                err = datagram_send_ctl(msg, &fl, opt, &hlimit, &tclass);
+                err = datagram_send_ctl(sock_net(sk), msg, &fl, opt, &hlimit, &tclass);
                if (err < 0) {
                        fl6_sock_release(flowlabel);
                        return err;
@@ -1164,6 +1164,14 @@ static void rawv6_close(struct sock *sk, long timeout)
        sk_common_release(sk);
 }
+static int raw6_destroy(struct sock *sk)
+{
+        lock_sock(sk);
+        ip6_flush_pending_frames(sk);
+        release_sock(sk);
+        return 0;
+}
 static int rawv6_init_sk(struct sock *sk)
 {
        struct raw6_sock *rp = raw6_sk(sk);
@@ -1187,6 +1195,7 @@ struct proto rawv6_prot = {
        .name              = "RAWv6",
        .owner             = THIS_MODULE,
        .close             = rawv6_close,
+        .destroy           = raw6_destroy,
        .connect           = ip6_datagram_connect,
        .disconnect        = udp_disconnect,
        .ioctl             = rawv6_ioctl,
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 48534c6c0735..220cffe9e63b 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -446,7 +446,7 @@ int rt6_route_rcv(struct net_device *dev, u8 *opt, int len,
        struct route_info *rinfo = (struct route_info *) opt;
        struct in6_addr prefix_buf, *prefix;
        unsigned int pref;
-        u32 lifetime;
+        unsigned long lifetime;
        struct rt6_info *rt;
        if (len < sizeof(struct route_info)) {
@@ -472,13 +472,7 @@ int rt6_route_rcv(struct net_device *dev, u8 *opt, int len,
        if (pref == ICMPV6_ROUTER_PREF_INVALID)
                pref = ICMPV6_ROUTER_PREF_MEDIUM;
-        lifetime = ntohl(rinfo->lifetime);
+        lifetime = addrconf_timeout_fixup(ntohl(rinfo->lifetime), HZ);
-        if (lifetime == 0xffffffff) {
-                /* infinity */
-        } else if (lifetime > 0x7fffffff/HZ - 1) {
-                /* Avoid arithmetic overflow */
-                lifetime = 0x7fffffff/HZ - 1;
-        }
        if (rinfo->length == 3)
                prefix = (struct in6_addr *)rinfo->prefix;
@@ -506,7 +500,7 @@ int rt6_route_rcv(struct net_device *dev, u8 *opt, int len,
                                 (rt->rt6i_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);
        if (rt) {
-                if (lifetime == 0xffffffff) {
+                if (!addrconf_finite_timeout(lifetime)) {
                        rt->rt6i_flags &= ~RTF_EXPIRES;
                } else {
                        rt->rt6i_expires = jiffies + HZ * lifetime;
diff --git a/net/ipv6/tunnel6.c b/net/ipv6/tunnel6.c
index 6323921b40be..669f280989c3 100644
--- a/net/ipv6/tunnel6.c
+++ b/net/ipv6/tunnel6.c
@@ -109,7 +109,7 @@ static int tunnel46_rcv(struct sk_buff *skb)
 {
        struct xfrm6_tunnel *handler;
-        if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
+        if (!pskb_may_pull(skb, sizeof(struct iphdr)))
                goto drop;
        for (handler = tunnel46_handlers; handler; handler = handler->next)
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 1fd784f3e2ec..dd309626ae9a 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -534,7 +534,9 @@ static void udp_v6_flush_pending_frames(struct sock *sk)
 {
        struct udp_sock *up = udp_sk(sk);
-        if (up->pending) {
+        if (up->pending == AF_INET)
+                udp_flush_pending_frames(sk);
+        else if (up->pending) {
                up->len = 0;
                up->pending = 0;
                ip6_flush_pending_frames(sk);
@@ -731,7 +733,7 @@ do_udp_sendmsg:
                memset(opt, 0, sizeof(struct ipv6_txoptions));
                opt->tot_len = sizeof(*opt);
-                err = datagram_send_ctl(msg, &fl, opt, &hlimit, &tclass);
+                err = datagram_send_ctl(sock_net(sk), msg, &fl, opt, &hlimit, &tclass);
                if (err < 0) {
                        fl6_sock_release(flowlabel);
                        return err;
@@ -848,12 +850,14 @@ do_append_data:
                } else {
                        dst_release(dst);
                }
+                dst = NULL;
        }
        if (err > 0)
                err = np->recverr ? net_xmit_errno(err) : 0;
        release_sock(sk);
 out:
+        dst_release(dst);
        fl6_sock_release(flowlabel);
        if (!err)
                return len;
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index ae54b20d0470..3eb5bcc75f99 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -1093,11 +1093,6 @@ static int irda_create(struct net *net, struct socket *sock, int protocol)
        init_waitqueue_head(&self->query_wait);
-        /* Initialise networking socket struct */
-        sock_init_data(sock, sk);       /* Note : set sk->sk_refcnt to 1 */
-        sk->sk_family = PF_IRDA;
-        sk->sk_protocol = protocol;
        switch (sock->type) {
        case SOCK_STREAM:
                sock->ops = &irda_stream_ops;
@@ -1124,13 +1119,20 @@ static int irda_create(struct net *net, struct socket *sock, int protocol)
                        self->max_sdu_size_rx = TTP_SAR_UNBOUND;
                        break;
                default:
+                        sk_free(sk);
                        return -ESOCKTNOSUPPORT;
                }
                break;
        default:
+                sk_free(sk);
                return -ESOCKTNOSUPPORT;
        }
+        /* Initialise networking socket struct */
+        sock_init_data(sock, sk);       /* Note : set sk->sk_refcnt to 1 */
+        sk->sk_family = PF_IRDA;
+        sk->sk_protocol = protocol;
        /* Register as a client with IrLMP */
        self->ckey = irlmp_register_client(0, NULL, NULL, NULL);
        self->mask.word = 0xffff;
diff --git a/net/llc/llc_sap.c b/net/llc/llc_sap.c
index e2ddde755019..008de1fc42ca 100644
--- a/net/llc/llc_sap.c
+++ b/net/llc/llc_sap.c
@@ -286,12 +286,14 @@ void llc_build_and_send_xid_pkt(struct llc_sap *sap, struct sk_buff *skb,
 *
 *      Sends received pdus to the sap state machine.
 */
-static void llc_sap_rcv(struct llc_sap *sap, struct sk_buff *skb)
+static void llc_sap_rcv(struct llc_sap *sap, struct sk_buff *skb,
+                        struct sock *sk)
 {
        struct llc_sap_state_ev *ev = llc_sap_ev(skb);
        ev->type   = LLC_SAP_EV_TYPE_PDU;
        ev->reason = 0;
+        skb->sk = sk;
        llc_sap_state_process(sap, skb);
 }
@@ -360,8 +362,7 @@ static void llc_sap_mcast(struct llc_sap *sap,
                        break;
                sock_hold(sk);
-                skb_set_owner_r(skb1, sk);
+                llc_sap_rcv(sap, skb1, sk);
-                llc_sap_rcv(sap, skb1);
                sock_put(sk);
        }
        read_unlock_bh(&sap->sk_list.lock);
@@ -381,8 +382,7 @@ void llc_sap_handler(struct llc_sap *sap, struct sk_buff *skb)
        } else {
                struct sock *sk = llc_lookup_dgram(sap, &laddr);
                if (sk) {
-                        skb_set_owner_r(skb, sk);
+                        llc_sap_rcv(sap, skb, sk);
-                        llc_sap_rcv(sap, skb);
                        sock_put(sk);
                } else
                        kfree_skb(skb);
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index dbf0563c397d..81087281b031 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -674,7 +674,7 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
        if (params->vlan) {
                sdata = IEEE80211_DEV_TO_SUB_IF(params->vlan);
-                if (sdata->vif.type != IEEE80211_IF_TYPE_VLAN ||
+                if (sdata->vif.type != IEEE80211_IF_TYPE_VLAN &&
                    sdata->vif.type != IEEE80211_IF_TYPE_AP)
                        return -EINVAL;
        } else
@@ -762,7 +762,7 @@ static int ieee80211_change_station(struct wiphy *wiphy,
        if (params->vlan && params->vlan != sta->sdata->dev) {
                vlansdata = IEEE80211_DEV_TO_SUB_IF(params->vlan);
-                if (vlansdata->vif.type != IEEE80211_IF_TYPE_VLAN ||
+                if (vlansdata->vif.type != IEEE80211_IF_TYPE_VLAN &&
                    vlansdata->vif.type != IEEE80211_IF_TYPE_AP) {
                        rcu_read_unlock();
                        return -EINVAL;
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 432011cd3647..884be4d100f1 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -853,7 +853,29 @@ u32 ieee80211_handle_ht(struct ieee80211_local *local, int enable_ht,
 /* ieee80211_ioctl.c */
 extern const struct iw_handler_def ieee80211_iw_handler_def;
-int ieee80211_set_freq(struct ieee80211_local *local, int freq);
+/* Least common multiple of the used rates (in 100 kbps). This is used to
+ * calculate rate_inv values for each rate so that only integers are needed. */
+#define CHAN_UTIL_RATE_LCM 95040
+/* 1 usec is 1/8 * (95040/10) = 1188 */
+#define CHAN_UTIL_PER_USEC 1188
+/* Amount of bits to shift the result right to scale the total utilization
+ * to values that will not wrap around 32-bit integers. */
+#define CHAN_UTIL_SHIFT 9
+/* Theoretical maximum of channel utilization counter in 10 ms (stat_time=1):
+ * (CHAN_UTIL_PER_USEC * 10000) >> CHAN_UTIL_SHIFT = 23203. So dividing the
+ * raw value with about 23 should give utilization in 10th of a percentage
+ * (1/1000). However, utilization is only estimated and not all intervals
+ * between frames etc. are calculated. 18 seems to give numbers that are closer
+ * to the real maximum. */
+#define CHAN_UTIL_PER_10MS 18
+#define CHAN_UTIL_HDR_LONG (202 * CHAN_UTIL_PER_USEC)
+#define CHAN_UTIL_HDR_SHORT (40 * CHAN_UTIL_PER_USEC)
+/* ieee80211_ioctl.c */
+int ieee80211_set_freq(struct net_device *dev, int freq);
 /* ieee80211_sta.c */
 void ieee80211_sta_timer(unsigned long data);
 void ieee80211_sta_work(struct work_struct *work);
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index f79f6b9938a6..b182f018a187 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -516,6 +516,7 @@ static int ieee80211_stop(struct net_device *dev)
        case IEEE80211_IF_TYPE_STA:
        case IEEE80211_IF_TYPE_IBSS:
                sdata->u.sta.state = IEEE80211_DISABLED;
+                memset(sdata->u.sta.bssid, 0, ETH_ALEN);
                del_timer_sync(&sdata->u.sta.timer);
                /*
                 * When we get here, the interface is marked down.
@@ -1314,7 +1315,7 @@ static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
        /*
         * Clear the TX filter mask for this STA when sending the next
         * packet. If the STA went to power save mode, this will happen
-         * happen when it wakes up for the next time.
+         * when it wakes up for the next time.
         */
        set_sta_flags(sta, WLAN_STA_CLEAR_PS_FILT);
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index adbc1c804dd3..7f05820dc629 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -44,7 +44,7 @@
 #define IEEE80211_RETRY_AUTH_INTERVAL (1 * HZ)
 #define IEEE80211_SCAN_INTERVAL (2 * HZ)
 #define IEEE80211_SCAN_INTERVAL_SLOW (15 * HZ)
-#define IEEE80211_IBSS_JOIN_TIMEOUT (20 * HZ)
+#define IEEE80211_IBSS_JOIN_TIMEOUT (7 * HZ)
 #define IEEE80211_PROBE_DELAY (HZ / 33)
 #define IEEE80211_CHANNEL_TIME (HZ / 33)
@@ -1337,7 +1337,7 @@ static void ieee80211_sta_process_addba_request(struct net_device *dev,
        /* prepare reordering buffer */
        tid_agg_rx->reorder_buf =
-                kmalloc(buf_size * sizeof(struct sk_buf *), GFP_ATOMIC);
+                kmalloc(buf_size * sizeof(struct sk_buff *), GFP_ATOMIC);
        if (!tid_agg_rx->reorder_buf) {
                if (net_ratelimit())
                        printk(KERN_ERR "can not allocate reordering buffer "
@@ -1346,7 +1346,7 @@ static void ieee80211_sta_process_addba_request(struct net_device *dev,
                goto end;
        }
        memset(tid_agg_rx->reorder_buf, 0,
-                buf_size * sizeof(struct sk_buf *));
+                buf_size * sizeof(struct sk_buff *));
        if (local->ops->ampdu_action)
                ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_START,
@@ -1625,7 +1625,7 @@ void sta_addba_resp_timer_expired(unsigned long data)
         * only one argument, and both sta_info and TID are needed, so init
         * flow in sta_info_create gives the TID as data, while the timer_to_id
         * array gives the sta through container_of */
-        u16 tid = *(int *)data;
+        u16 tid = *(u8 *)data;
        struct sta_info *temp_sta = container_of((void *)data,
                struct sta_info, timer_to_tid[tid]);
@@ -1673,7 +1673,7 @@ timer_expired_exit:
 static void sta_rx_agg_session_timer_expired(unsigned long data)
 {
        /* not an elegant detour, but there is no choice as the timer passes
-         * only one argument, and verious sta_info are needed here, so init
+         * only one argument, and various sta_info are needed here, so init
         * flow in sta_info_create gives the TID as data, while the timer_to_id
         * array gives the sta through container_of */
        u8 *ptid = (u8 *)data;
@@ -2348,6 +2348,7 @@ static int ieee80211_sta_join_ibss(struct net_device *dev,
        u8 *pos;
        struct ieee80211_sub_if_data *sdata;
        struct ieee80211_supported_band *sband;
+        union iwreq_data wrqu;
        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
@@ -2370,13 +2371,10 @@ static int ieee80211_sta_join_ibss(struct net_device *dev,
        sdata->drop_unencrypted = bss->capability &
                WLAN_CAPABILITY_PRIVACY ? 1 : 0;
-        res = ieee80211_set_freq(local, bss->freq);
+        res = ieee80211_set_freq(dev, bss->freq);
-        if (local->oper_channel->flags & IEEE80211_CHAN_NO_IBSS) {
+        if (res)
-                printk(KERN_DEBUG "%s: IBSS not allowed on frequency "
+                return res;
-                       "%d MHz\n", dev->name, local->oper_channel->center_freq);
-                return -1;
-        }
        /* Set beacon template */
        skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
@@ -2491,7 +2489,9 @@ static int ieee80211_sta_join_ibss(struct net_device *dev,
        ifsta->state = IEEE80211_IBSS_JOINED;
        mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
-        ieee80211_rx_bss_put(dev, bss);
+        memset(&wrqu, 0, sizeof(wrqu));
+        memcpy(wrqu.ap_addr.sa_data, bss->bssid, ETH_ALEN);
+        wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
        return res;
 }
@@ -3518,7 +3518,7 @@ static int ieee80211_sta_config_auth(struct net_device *dev,
        spin_unlock_bh(&local->sta_bss_lock);
        if (selected) {
-                ieee80211_set_freq(local, selected->freq);
+                ieee80211_set_freq(dev, selected->freq);
                if (!(ifsta->flags & IEEE80211_STA_SSID_SET))
                        ieee80211_sta_set_ssid(dev, selected->ssid,
                                               selected->ssid_len);
@@ -3553,6 +3553,7 @@ static int ieee80211_sta_create_ibss(struct net_device *dev,
        struct ieee80211_supported_band *sband;
        u8 bssid[ETH_ALEN], *pos;
        int i;
+        int ret;
        DECLARE_MAC_BUF(mac);
 #if 0
@@ -3599,7 +3600,9 @@ static int ieee80211_sta_create_ibss(struct net_device *dev,
                *pos++ = (u8) (rate / 5);
        }
-        return ieee80211_sta_join_ibss(dev, ifsta, bss);
+        ret = ieee80211_sta_join_ibss(dev, ifsta, bss);
+        ieee80211_rx_bss_put(dev, bss);
+        return ret;
 }
@@ -3647,10 +3650,13 @@ static int ieee80211_sta_find_ibss(struct net_device *dev,
            (bss = ieee80211_rx_bss_get(dev, bssid,
                                        local->hw.conf.channel->center_freq,
                                        ifsta->ssid, ifsta->ssid_len))) {
+                int ret;
                printk(KERN_DEBUG "%s: Selected IBSS BSSID %s"
                       " based on configured SSID\n",
                       dev->name, print_mac(mac, bssid));
-                return ieee80211_sta_join_ibss(dev, ifsta, bss);
+                ret = ieee80211_sta_join_ibss(dev, ifsta, bss);
+                ieee80211_rx_bss_put(dev, bss);
+                return ret;
        }
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
        printk(KERN_DEBUG "   did not try to join ibss\n");
@@ -4127,18 +4133,17 @@ ieee80211_sta_scan_result(struct net_device *dev,
        memset(&iwe, 0, sizeof(iwe));
        iwe.cmd = SIOCGIWFREQ;
-        iwe.u.freq.m = bss->freq;
+        iwe.u.freq.m = ieee80211_frequency_to_channel(bss->freq);
-        iwe.u.freq.e = 6;
+        iwe.u.freq.e = 0;
        current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
                                          IW_EV_FREQ_LEN);
        memset(&iwe, 0, sizeof(iwe));
        iwe.cmd = SIOCGIWFREQ;
-        iwe.u.freq.m = ieee80211_frequency_to_channel(bss->freq);
+        iwe.u.freq.m = bss->freq;
-        iwe.u.freq.e = 0;
+        iwe.u.freq.e = 6;
        current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
                                          IW_EV_FREQ_LEN);
        memset(&iwe, 0, sizeof(iwe));
        iwe.cmd = IWEVQUAL;
        iwe.u.qual.qual = bss->qual;
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 9400a9766a77..a3643fd86af9 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1116,7 +1116,7 @@ ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
        u16 fc, hdrlen, ethertype;
        u8 *payload;
        u8 dst[ETH_ALEN];
-        u8 src[ETH_ALEN];
+        u8 src[ETH_ALEN] __aligned(2);
        struct sk_buff *skb = rx->skb;
        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
        DECLARE_MAC_BUF(mac);
@@ -1259,7 +1259,7 @@ ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
 */
 static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx)
 {
-        static const u8 pae_group_addr[ETH_ALEN]
+        static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
                = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
        struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 5a77e2c01f49..6513bc2d2707 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -34,11 +34,11 @@ void *mac80211_wiphy_privid = &mac80211_wiphy_privid;
 /* See IEEE 802.1H for LLC/SNAP encapsulation/decapsulation */
 /* Ethernet-II snap header (RFC1042 for most EtherTypes) */
-const unsigned char rfc1042_header[] =
+const unsigned char rfc1042_header[] __aligned(2) =
        { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
 /* Bridge-Tunnel header (for EtherTypes ETH_P_AARP and ETH_P_IPX) */
-const unsigned char bridge_tunnel_header[] =
+const unsigned char bridge_tunnel_header[] __aligned(2) =
        { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 };
diff --git a/net/mac80211/wext.c b/net/mac80211/wext.c
index c2e2378af082..4806d96b9877 100644
--- a/net/mac80211/wext.c
+++ b/net/mac80211/wext.c
@@ -302,14 +302,22 @@ static int ieee80211_ioctl_giwmode(struct net_device *dev,
        return 0;
 }
-int ieee80211_set_freq(struct ieee80211_local *local, int freqMHz)
+int ieee80211_set_freq(struct net_device *dev, int freqMHz)
 {
        int ret = -EINVAL;
        struct ieee80211_channel *chan;
+        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
        chan = ieee80211_get_channel(local->hw.wiphy, freqMHz);
        if (chan && !(chan->flags & IEEE80211_CHAN_DISABLED)) {
+                if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS &&
+                    chan->flags & IEEE80211_CHAN_NO_IBSS) {
+                        printk(KERN_DEBUG "%s: IBSS not allowed on frequency "
+                                "%d MHz\n", dev->name, chan->center_freq);
+                        return ret;
+                }
                local->oper_channel = chan;
                if (local->sta_sw_scanning || local->sta_hw_scanning)
@@ -327,7 +335,6 @@ static int ieee80211_ioctl_siwfreq(struct net_device *dev,
                                   struct iw_request_info *info,
                                   struct iw_freq *freq, char *extra)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
        if (sdata->vif.type == IEEE80211_IF_TYPE_STA)
@@ -341,14 +348,14 @@ static int ieee80211_ioctl_siwfreq(struct net_device *dev,
                                        IEEE80211_STA_AUTO_CHANNEL_SEL;
                        return 0;
                } else
-                        return ieee80211_set_freq(local,
+                        return ieee80211_set_freq(dev,
                                ieee80211_channel_to_frequency(freq->m));
        } else {
                int i, div = 1000000;
                for (i = 0; i < freq->e; i++)
                        div /= 10;
                if (div > 0)
-                        return ieee80211_set_freq(local, freq->m / div);
+                        return ieee80211_set_freq(dev, freq->m / div);
                else
                        return -EINVAL;
        }
@@ -501,9 +508,14 @@ static int ieee80211_ioctl_giwap(struct net_device *dev,
        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
        if (sdata->vif.type == IEEE80211_IF_TYPE_STA ||
            sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
-                ap_addr->sa_family = ARPHRD_ETHER;
+                if (sdata->u.sta.state == IEEE80211_ASSOCIATED) {
-                memcpy(&ap_addr->sa_data, sdata->u.sta.bssid, ETH_ALEN);
+                        ap_addr->sa_family = ARPHRD_ETHER;
-                return 0;
+                        memcpy(&ap_addr->sa_data, sdata->u.sta.bssid, ETH_ALEN);
+                        return 0;
+                } else {
+                        memset(&ap_addr->sa_data, 0, ETH_ALEN);
+                        return 0;
+                }
        } else if (sdata->vif.type == IEEE80211_IF_TYPE_WDS) {
                ap_addr->sa_family = ARPHRD_ETHER;
                memcpy(&ap_addr->sa_data, sdata->u.wds.remote_addr, ETH_ALEN);
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index e31beeb33b2b..e8f0dead267f 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -587,10 +587,10 @@ int __init nf_conntrack_expect_init(void)
        return 0;
 err3:
+        kmem_cache_destroy(nf_ct_expect_cachep);
+err2:
        nf_ct_free_hashtable(nf_ct_expect_hash, nf_ct_expect_vmalloc,
                             nf_ct_expect_hsize);
-err2:
-        kmem_cache_destroy(nf_ct_expect_cachep);
 err1:
        return err;
 }
diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c
index 2e89a00df92c..70907f6baac3 100644
--- a/net/netfilter/xt_connlimit.c
+++ b/net/netfilter/xt_connlimit.c
@@ -73,7 +73,8 @@ connlimit_iphash6(const union nf_inet_addr *addr,
 static inline bool already_closed(const struct nf_conn *conn)
 {
        if (nf_ct_protonum(conn) == IPPROTO_TCP)
-                return conn->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT;
+                return conn->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT ||
+                       conn->proto.tcp.state == TCP_CONNTRACK_CLOSE;
        else
                return 0;
 }
diff --git a/net/netlink/attr.c b/net/netlink/attr.c
index feb326f4a752..47bbf45ae5d7 100644
--- a/net/netlink/attr.c
+++ b/net/netlink/attr.c
@@ -400,13 +400,13 @@ void __nla_put_nohdr(struct sk_buff *skb, int attrlen, const void *data)
 * @attrlen: length of attribute payload
 * @data: head of attribute payload
 *
- * Returns -1 if the tailroom of the skb is insufficient to store
+ * Returns -EMSGSIZE if the tailroom of the skb is insufficient to store
 * the attribute header and payload.
 */
 int nla_put(struct sk_buff *skb, int attrtype, int attrlen, const void *data)
 {
        if (unlikely(skb_tailroom(skb) < nla_total_size(attrlen)))
-                return -1;
+                return -EMSGSIZE;
        __nla_put(skb, attrtype, attrlen, data);
        return 0;
@@ -418,13 +418,13 @@ int nla_put(struct sk_buff *skb, int attrtype, int attrlen, const void *data)
 * @attrlen: length of attribute payload
 * @data: head of attribute payload
 *
- * Returns -1 if the tailroom of the skb is insufficient to store
+ * Returns -EMSGSIZE if the tailroom of the skb is insufficient to store
 * the attribute payload.
 */
 int nla_put_nohdr(struct sk_buff *skb, int attrlen, const void *data)
 {
        if (unlikely(skb_tailroom(skb) < NLA_ALIGN(attrlen)))
-                return -1;
+                return -EMSGSIZE;
        __nla_put_nohdr(skb, attrlen, data);
        return 0;
@@ -436,13 +436,13 @@ int nla_put_nohdr(struct sk_buff *skb, int attrlen, const void *data)
 * @attrlen: length of attribute payload
 * @data: head of attribute payload
 *
- * Returns -1 if the tailroom of the skb is insufficient to store
+ * Returns -EMSGSIZE if the tailroom of the skb is insufficient to store
 * the attribute payload.
 */
 int nla_append(struct sk_buff *skb, int attrlen, const void *data)
 {
        if (unlikely(skb_tailroom(skb) < NLA_ALIGN(attrlen)))
-                return -1;
+                return -EMSGSIZE;
        memcpy(skb_put(skb, attrlen), data, attrlen);
        return 0;
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index d16929c9b4bc..f5aa23c3e886 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -554,7 +554,8 @@ static int ctrl_fill_info(struct genl_family *family, u32 pid, u32 seq,
        return genlmsg_end(skb, hdr);
 nla_put_failure:
-        return genlmsg_cancel(skb, hdr);
+        genlmsg_cancel(skb, hdr);
+        return -EMSGSIZE;
 }
 static int ctrl_fill_mcgrp_info(struct genl_multicast_group *grp, u32 pid,
@@ -590,7 +591,8 @@ static int ctrl_fill_mcgrp_info(struct genl_multicast_group *grp, u32 pid,
        return genlmsg_end(skb, hdr);
 nla_put_failure:
-        return genlmsg_cancel(skb, hdr);
+        genlmsg_cancel(skb, hdr);
+        return -EMSGSIZE;
 }
 static int ctrl_dumpfamily(struct sk_buff *skb, struct netlink_callback *cb)
diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c
index 0df911fd67b1..64465bacbe79 100644
--- a/net/sched/sch_dsmark.c
+++ b/net/sched/sch_dsmark.c
@@ -444,7 +444,8 @@ static int dsmark_dump_class(struct Qdisc *sch, unsigned long cl,
        return nla_nest_end(skb, opts);
 nla_put_failure:
-        return nla_nest_cancel(skb, opts);
+        nla_nest_cancel(skb, opts);
+        return -EMSGSIZE;
 }
 static int dsmark_dump(struct Qdisc *sch, struct sk_buff *skb)
@@ -466,7 +467,8 @@ static int dsmark_dump(struct Qdisc *sch, struct sk_buff *skb)
        return nla_nest_end(skb, opts);
 nla_put_failure:
-        return nla_nest_cancel(skb, opts);
+        nla_nest_cancel(skb, opts);
+        return -EMSGSIZE;
 }
 static const struct Qdisc_class_ops dsmark_class_ops = {
diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c
index 3a9d226ff1e4..c89fba56db56 100644
--- a/net/sched/sch_gred.c
+++ b/net/sched/sch_gred.c
@@ -582,7 +582,8 @@ append_opt:
        return nla_nest_end(skb, opts);
 nla_put_failure:
-        return nla_nest_cancel(skb, opts);
+        nla_nest_cancel(skb, opts);
+        return -EMSGSIZE;
 }
 static void gred_destroy(struct Qdisc *sch)
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 87293d0db1d7..fdfaa3fcc16d 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1360,7 +1360,7 @@ hfsc_dump_class(struct Qdisc *sch, unsigned long arg, struct sk_buff *skb,
 nla_put_failure:
        nla_nest_cancel(skb, nest);
-        return -1;
+        return -EMSGSIZE;
 }
 static int
diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
index 3dcd493f4f4a..5c569853b9c0 100644
--- a/net/sched/sch_red.c
+++ b/net/sched/sch_red.c
@@ -281,7 +281,8 @@ static int red_dump(struct Qdisc *sch, struct sk_buff *skb)
        return nla_nest_end(skb, opts);
 nla_put_failure:
-        return nla_nest_cancel(skb, opts);
+        nla_nest_cancel(skb, opts);
+        return -EMSGSIZE;
 }
 static int red_dump_stats(struct Qdisc *sch, struct gnet_dump *d)
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 7b79d1e781a8..d5cc731b6798 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -1206,6 +1206,9 @@ void sctp_assoc_update_retran_path(struct sctp_association *asoc)
        struct list_head *head = &asoc->peer.transport_addr_list;
        struct list_head *pos;
+        if (asoc->peer.transport_count == 1)
+                return;
        /* Find the next transport in a round-robin fashion. */
        t = asoc->peer.retran_path;
        pos = &t->transports;
@@ -1220,6 +1223,15 @@ void sctp_assoc_update_retran_path(struct sctp_association *asoc)
                t = list_entry(pos, struct sctp_transport, transports);
+                /* We have exhausted the list, but didn't find any
+                 * other active transports.  If so, use the next
+                 * transport.
+                 */
+                if (t == asoc->peer.retran_path) {
+                        t = next;
+                        break;
+                }
                /* Try to find an active transport. */
                if ((t->state == SCTP_ACTIVE) ||
@@ -1232,15 +1244,6 @@ void sctp_assoc_update_retran_path(struct sctp_association *asoc)
                        if (!next)
                                next = t;
                }
-                /* We have exhausted the list, but didn't find any
-                 * other active transports.  If so, use the next
-                 * transport.
-                 */
-                if (t == asoc->peer.retran_path) {
-                        t = next;
-                        break;
-                }
        }
        asoc->peer.retran_path = t;
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index e45e44c60635..a2f4d4d51593 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -299,7 +299,8 @@ static inline int sctp_v6_addr_match_len(union sctp_addr *s1,
 /* Fills in the source address(saddr) based on the destination address(daddr)
 * and asoc's bind address list.
 */
-static void sctp_v6_get_saddr(struct sctp_association *asoc,
+static void sctp_v6_get_saddr(struct sctp_sock *sk,
+                              struct sctp_association *asoc,
                              struct dst_entry *dst,
                              union sctp_addr *daddr,
                              union sctp_addr *saddr)
@@ -318,7 +319,7 @@ static void sctp_v6_get_saddr(struct sctp_association *asoc,
        if (!asoc) {
                ipv6_dev_get_saddr(dst ? ip6_dst_idev(dst)->dev : NULL,
                                   &daddr->v6.sin6_addr,
-                                   inet6_sk(asoc->base.sk)->srcprefs,
+                                   inet6_sk(&sk->inet.sk)->srcprefs,
                                   &saddr->v6.sin6_addr);
                SCTP_DEBUG_PRINTK("saddr from ipv6_get_saddr: " NIP6_FMT "\n",
                                  NIP6(saddr->v6.sin6_addr));
@@ -726,6 +727,11 @@ static void sctp_v6_seq_dump_addr(struct seq_file *seq, union sctp_addr *addr)
        seq_printf(seq, NIP6_FMT " ", NIP6(addr->v6.sin6_addr));
 }
+static void sctp_v6_ecn_capable(struct sock *sk)
+{
+        inet6_sk(sk)->tclass |= INET_ECN_ECT_0;
+}
 /* Initialize a PF_INET6 socket msg_name. */
 static void sctp_inet6_msgname(char *msgname, int *addr_len)
 {
@@ -996,6 +1002,7 @@ static struct sctp_af sctp_af_inet6 = {
        .skb_iif           = sctp_v6_skb_iif,
        .is_ce             = sctp_v6_is_ce,
        .seq_dump_addr     = sctp_v6_seq_dump_addr,
+        .ecn_capable       = sctp_v6_ecn_capable,
        .net_header_len    = sizeof(struct ipv6hdr),
        .sockaddr_len      = sizeof(struct sockaddr_in6),
 #ifdef CONFIG_COMPAT
diff --git a/net/sctp/output.c b/net/sctp/output.c
index cf4f9fb6819d..6d45bae93b46 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -548,7 +548,7 @@ int sctp_packet_transmit(struct sctp_packet *packet)
         * Note: The works for IPv6 layer checks this bit too later
         * in transmission.  See IP6_ECN_flow_xmit().
         */
-        INET_ECN_xmit(nskb->sk);
+        (*tp->af_specific->ecn_capable)(nskb->sk);
        /* Set up the IP options.  */
        /* BUG: not implemented
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 59edfd25a19c..ace6770e9048 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -208,6 +208,7 @@ void sctp_outq_init(struct sctp_association *asoc, struct sctp_outq *q)
        INIT_LIST_HEAD(&q->sacked);
        INIT_LIST_HEAD(&q->abandoned);
+        q->fast_rtx = 0;
        q->outstanding_bytes = 0;
        q->empty = 1;
        q->cork  = 0;
@@ -500,6 +501,7 @@ void sctp_retransmit(struct sctp_outq *q, struct sctp_transport *transport,
        case SCTP_RTXR_FAST_RTX:
                SCTP_INC_STATS(SCTP_MIB_FAST_RETRANSMITS);
                sctp_transport_lower_cwnd(transport, SCTP_LOWER_CWND_FAST_RTX);
+                q->fast_rtx = 1;
                break;
        case SCTP_RTXR_PMTUD:
                SCTP_INC_STATS(SCTP_MIB_PMTUD_RETRANSMITS);
@@ -518,9 +520,15 @@ void sctp_retransmit(struct sctp_outq *q, struct sctp_transport *transport,
         * the sender SHOULD try to advance the "Advanced.Peer.Ack.Point" by
         * following the procedures outlined in C1 - C5.
         */
-        sctp_generate_fwdtsn(q, q->asoc->ctsn_ack_point);
+        if (reason == SCTP_RTXR_T3_RTX)
+                sctp_generate_fwdtsn(q, q->asoc->ctsn_ack_point);
-        error = sctp_outq_flush(q, /* rtx_timeout */ 1);
+        /* Flush the queues only on timeout, since fast_rtx is only
+         * triggered during sack processing and the queue
+         * will be flushed at the end.
+         */
+        if (reason != SCTP_RTXR_FAST_RTX)
+                error = sctp_outq_flush(q, /* rtx_timeout */ 1);
        if (error)
                q->asoc->base.sk->sk_err = -error;
@@ -538,17 +546,23 @@ static int sctp_outq_flush_rtx(struct sctp_outq *q, struct sctp_packet *pkt,
                               int rtx_timeout, int *start_timer)
 {
        struct list_head *lqueue;
-        struct list_head *lchunk;
        struct sctp_transport *transport = pkt->transport;
        sctp_xmit_t status;
        struct sctp_chunk *chunk, *chunk1;
        struct sctp_association *asoc;
+        int fast_rtx;
        int error = 0;
+        int timer = 0;
+        int done = 0;
        asoc = q->asoc;
        lqueue = &q->retransmit;
+        fast_rtx = q->fast_rtx;
-        /* RFC 2960 6.3.3 Handle T3-rtx Expiration
+        /* This loop handles time-out retransmissions, fast retransmissions,
+         * and retransmissions due to opening of whindow.
+         *
+         * RFC 2960 6.3.3 Handle T3-rtx Expiration
         *
         * E3) Determine how many of the earliest (i.e., lowest TSN)
         * outstanding DATA chunks for the address for which the
@@ -563,12 +577,12 @@ static int sctp_outq_flush_rtx(struct sctp_outq *q, struct sctp_packet *pkt,
         * [Just to be painfully clear, if we are retransmitting
         * because a timeout just happened, we should send only ONE
         * packet of retransmitted data.]
+         *
+         * For fast retransmissions we also send only ONE packet.  However,
+         * if we are just flushing the queue due to open window, we'll
+         * try to send as much as possible.
         */
-        lchunk = sctp_list_dequeue(lqueue);
+        list_for_each_entry_safe(chunk, chunk1, lqueue, transmitted_list) {
-        while (lchunk) {
-                chunk = list_entry(lchunk, struct sctp_chunk,
-                                   transmitted_list);
                /* Make sure that Gap Acked TSNs are not retransmitted.  A
                 * simple approach is just to move such TSNs out of the
@@ -576,58 +590,60 @@ static int sctp_outq_flush_rtx(struct sctp_outq *q, struct sctp_packet *pkt,
                 * next chunk.
                 */
                if (chunk->tsn_gap_acked) {
-                        list_add_tail(lchunk, &transport->transmitted);
+                        list_del(&chunk->transmitted_list);
-                        lchunk = sctp_list_dequeue(lqueue);
+                        list_add_tail(&chunk->transmitted_list,
+                                        &transport->transmitted);
                        continue;
                }
+                /* If we are doing fast retransmit, ignore non-fast_rtransmit
+                 * chunks
+                 */
+                if (fast_rtx && !chunk->fast_retransmit)
+                        continue;
                /* Attempt to append this chunk to the packet. */
                status = sctp_packet_append_chunk(pkt, chunk);
                switch (status) {
                case SCTP_XMIT_PMTU_FULL:
                        /* Send this packet.  */
-                        if ((error = sctp_packet_transmit(pkt)) == 0)
+                        error = sctp_packet_transmit(pkt);
-                                *start_timer = 1;
                        /* If we are retransmitting, we should only
                         * send a single packet.
                         */
-                        if (rtx_timeout) {
+                        if (rtx_timeout || fast_rtx)
-                                list_add(lchunk, lqueue);
+                                done = 1;
-                                lchunk = NULL;
-                        }
-                        /* Bundle lchunk in the next round.  */
+                        /* Bundle next chunk in the next round.  */
                        break;
                case SCTP_XMIT_RWND_FULL:
                        /* Send this packet. */
-                        if ((error = sctp_packet_transmit(pkt)) == 0)
+                        error = sctp_packet_transmit(pkt);
-                                *start_timer = 1;
                        /* Stop sending DATA as there is no more room
                         * at the receiver.
                         */
-                        list_add(lchunk, lqueue);
+                        done = 1;
-                        lchunk = NULL;
                        break;
                case SCTP_XMIT_NAGLE_DELAY:
                        /* Send this packet. */
-                        if ((error = sctp_packet_transmit(pkt)) == 0)
+                        error = sctp_packet_transmit(pkt);
-                                *start_timer = 1;
                        /* Stop sending DATA because of nagle delay. */
-                        list_add(lchunk, lqueue);
+                        done = 1;
-                        lchunk = NULL;
                        break;
                default:
                        /* The append was successful, so add this chunk to
                         * the transmitted list.
                         */
-                        list_add_tail(lchunk, &transport->transmitted);
+                        list_del(&chunk->transmitted_list);
+                        list_add_tail(&chunk->transmitted_list,
+                                        &transport->transmitted);
                        /* Mark the chunk as ineligible for fast retransmit
                         * after it is retransmitted.
@@ -635,27 +651,44 @@ static int sctp_outq_flush_rtx(struct sctp_outq *q, struct sctp_packet *pkt,
                        if (chunk->fast_retransmit > 0)
                                chunk->fast_retransmit = -1;
-                        *start_timer = 1;
+                        /* Force start T3-rtx timer when fast retransmitting
-                        q->empty = 0;
+                         * the earliest outstanding TSN
+                         */
+                        if (!timer && fast_rtx &&
+                            ntohl(chunk->subh.data_hdr->tsn) ==
+                                             asoc->ctsn_ack_point + 1)
+                                timer = 2;
-                        /* Retrieve a new chunk to bundle. */
+                        q->empty = 0;
-                        lchunk = sctp_list_dequeue(lqueue);
                        break;
                }
-                /* If we are here due to a retransmit timeout or a fast
+                /* Set the timer if there were no errors */
-                 * retransmit and if there are any chunks left in the retransmit
+                if (!error && !timer)
-                 * queue that could not fit in the PMTU sized packet, they need
+                        timer = 1;
-                 * to be marked as ineligible for a subsequent fast retransmit.
-                 */
+                if (done)
-                if (rtx_timeout && !lchunk) {
+                        break;
-                        list_for_each_entry(chunk1, lqueue, transmitted_list) {
+        }
-                                if (chunk1->fast_retransmit > 0)
-                                        chunk1->fast_retransmit = -1;
+        /* If we are here due to a retransmit timeout or a fast
-                        }
+         * retransmit and if there are any chunks left in the retransmit
+         * queue that could not fit in the PMTU sized packet, they need
+         * to be marked as ineligible for a subsequent fast retransmit.
+         */
+        if (rtx_timeout || fast_rtx) {
+                list_for_each_entry(chunk1, lqueue, transmitted_list) {
+                        if (chunk1->fast_retransmit > 0)
+                                chunk1->fast_retransmit = -1;
                }
        }
+        *start_timer = timer;
+        /* Clear fast retransmit hint */
+        if (fast_rtx)
+                q->fast_rtx = 0;
        return error;
 }
@@ -862,7 +895,8 @@ int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
                                                    rtx_timeout, &start_timer);
                        if (start_timer)
-                                sctp_transport_reset_timers(transport);
+                                sctp_transport_reset_timers(transport,
+                                                            start_timer-1);
                        /* This can happen on COOKIE-ECHO resend.  Only
                         * one chunk can get bundled with a COOKIE-ECHO.
@@ -977,7 +1011,7 @@ int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
                        list_add_tail(&chunk->transmitted_list,
                                      &transport->transmitted);
-                        sctp_transport_reset_timers(transport);
+                        sctp_transport_reset_timers(transport, start_timer-1);
                        q->empty = 0;
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index b8bd9e014498..d6af466091d2 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -473,11 +473,11 @@ static struct dst_entry *sctp_v4_get_dst(struct sctp_association *asoc,
                /* Walk through the bind address list and look for a bind
                 * address that matches the source address of the returned dst.
                 */
+                sctp_v4_dst_saddr(&dst_saddr, dst, htons(bp->port));
                rcu_read_lock();
                list_for_each_entry_rcu(laddr, &bp->address_list, list) {
                        if (!laddr->valid || (laddr->state != SCTP_ADDR_SRC))
                                continue;
-                        sctp_v4_dst_saddr(&dst_saddr, dst, htons(bp->port));
                        if (sctp_v4_cmp_addr(&dst_saddr, &laddr->a))
                                goto out_unlock;
                }
@@ -522,7 +522,8 @@ out:
 /* For v4, the source address is cached in the route entry(dst). So no need
 * to cache it separately and hence this is an empty routine.
 */
-static void sctp_v4_get_saddr(struct sctp_association *asoc,
+static void sctp_v4_get_saddr(struct sctp_sock *sk,
+                              struct sctp_association *asoc,
                              struct dst_entry *dst,
                              union sctp_addr *daddr,
                              union sctp_addr *saddr)
@@ -619,6 +620,11 @@ static void sctp_v4_seq_dump_addr(struct seq_file *seq, union sctp_addr *addr)
        seq_printf(seq, "%d.%d.%d.%d ", NIPQUAD(addr->v4.sin_addr));
 }
+static void sctp_v4_ecn_capable(struct sock *sk)
+{
+        INET_ECN_xmit(sk);
+}
 /* Event handler for inet address addition/deletion events.
 * The sctp_local_addr_list needs to be protocted by a spin lock since
 * multiple notifiers (say IPv4 and IPv6) may be running at the same
@@ -937,6 +943,7 @@ static struct sctp_af sctp_af_inet = {
        .skb_iif           = sctp_v4_skb_iif,
        .is_ce             = sctp_v4_is_ce,
        .seq_dump_addr     = sctp_v4_seq_dump_addr,
+        .ecn_capable       = sctp_v4_ecn_capable,
        .net_header_len    = sizeof(struct iphdr),
        .sockaddr_len      = sizeof(struct sockaddr_in),
 #ifdef CONFIG_COMPAT
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index f4938f6c5abe..3f34f61221ec 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -79,6 +79,7 @@ static struct sctp_transport *sctp_transport_init(struct sctp_transport *peer,
        peer->rttvar = 0;
        peer->srtt = 0;
        peer->rto_pending = 0;
+        peer->fast_recovery = 0;
        peer->last_time_heard = jiffies;
        peer->last_time_used = jiffies;
@@ -190,7 +191,7 @@ static void sctp_transport_destroy(struct sctp_transport *transport)
 /* Start T3_rtx timer if it is not already running and update the heartbeat
 * timer.  This routine is called every time a DATA chunk is sent.
 */
-void sctp_transport_reset_timers(struct sctp_transport *transport)
+void sctp_transport_reset_timers(struct sctp_transport *transport, int force)
 {
        /* RFC 2960 6.3.2 Retransmission Timer Rules
         *
@@ -200,7 +201,7 @@ void sctp_transport_reset_timers(struct sctp_transport *transport)
         * address.
         */
-        if (!timer_pending(&transport->T3_rtx_timer))
+        if (force || !timer_pending(&transport->T3_rtx_timer))
                if (!mod_timer(&transport->T3_rtx_timer,
                               jiffies + transport->rto))
                        sctp_transport_hold(transport);
@@ -291,7 +292,7 @@ void sctp_transport_route(struct sctp_transport *transport,
        if (saddr)
                memcpy(&transport->saddr, saddr, sizeof(union sctp_addr));
        else
-                af->get_saddr(asoc, dst, daddr, &transport->saddr);
+                af->get_saddr(opt, asoc, dst, daddr, &transport->saddr);
        transport->dst = dst;
        if ((transport->param_flags & SPP_PMTUD_DISABLE) && transport->pathmtu) {
@@ -403,11 +404,16 @@ void sctp_transport_raise_cwnd(struct sctp_transport *transport,
        cwnd = transport->cwnd;
        flight_size = transport->flight_size;
+        /* See if we need to exit Fast Recovery first */
+        if (transport->fast_recovery &&
+            TSN_lte(transport->fast_recovery_exit, sack_ctsn))
+                transport->fast_recovery = 0;
        /* The appropriate cwnd increase algorithm is performed if, and only
-         * if the cumulative TSN has advanced and the congestion window is
+         * if the cumulative TSN whould advanced and the congestion window is
         * being fully utilized.
         */
-        if ((transport->asoc->ctsn_ack_point >= sack_ctsn) ||
+        if (TSN_lte(sack_ctsn, transport->asoc->ctsn_ack_point) ||
            (flight_size < cwnd))
                return;
@@ -416,17 +422,23 @@ void sctp_transport_raise_cwnd(struct sctp_transport *transport,
        pmtu = transport->asoc->pathmtu;
        if (cwnd <= ssthresh) {
-                /* RFC 2960 7.2.1, sctpimpguide-05 2.14.2 When cwnd is less
+                /* RFC 4960 7.2.1
-                 * than or equal to ssthresh an SCTP endpoint MUST use the
+                 * o  When cwnd is less than or equal to ssthresh, an SCTP
-                 * slow start algorithm to increase cwnd only if the current
+                 *    endpoint MUST use the slow-start algorithm to increase
-                 * congestion window is being fully utilized and an incoming
+                 *    cwnd only if the current congestion window is being fully
-                 * SACK advances the Cumulative TSN Ack Point. Only when these
+                 *    utilized, an incoming SACK advances the Cumulative TSN
-                 * two conditions are met can the cwnd be increased otherwise
+                 *    Ack Point, and the data sender is not in Fast Recovery.
-                 * the cwnd MUST not be increased. If these conditions are met
+                 *    Only when these three conditions are met can the cwnd be
-                 * then cwnd MUST be increased by at most the lesser of
+                 *    increased; otherwise, the cwnd MUST not be increased.
-                 * 1) the total size of the previously outstanding DATA
+                 *    If these conditions are met, then cwnd MUST be increased
-                 * chunk(s) acknowledged, and 2) the destination's path MTU.
+                 *    by, at most, the lesser of 1) the total size of the
+                 *    previously outstanding DATA chunk(s) acknowledged, and
+                 *    2) the destination's path MTU.  This upper bound protects
+                 *    against the ACK-Splitting attack outlined in [SAVAGE99].
                 */
+                if (transport->fast_recovery)
+                        return;
                if (bytes_acked > pmtu)
                        cwnd += pmtu;
                else
@@ -502,6 +514,13 @@ void sctp_transport_lower_cwnd(struct sctp_transport *transport,
                 *      cwnd = ssthresh
                 *      partial_bytes_acked = 0
                 */
+                if (transport->fast_recovery)
+                        return;
+                /* Mark Fast recovery */
+                transport->fast_recovery = 1;
+                transport->fast_recovery_exit = transport->asoc->next_tsn - 1;
                transport->ssthresh = max(transport->cwnd/2,
                                          4*transport->asoc->pathmtu);
                transport->cwnd = transport->ssthresh;
@@ -586,6 +605,7 @@ void sctp_transport_reset(struct sctp_transport *t)
        t->flight_size = 0;
        t->error_count = 0;
        t->rto_pending = 0;
+        t->fast_recovery = 0;
        /* Initialize the state information for SFR-CACC */
        t->cacc.changeover_active = 0;
diff --git a/net/sunrpc/auth_generic.c b/net/sunrpc/auth_generic.c
index d927d9f57412..744b79fdcb19 100644
--- a/net/sunrpc/auth_generic.c
+++ b/net/sunrpc/auth_generic.c
@@ -17,8 +17,8 @@
 # define RPCDBG_FACILITY        RPCDBG_AUTH
 #endif
-#define RPC_ANONYMOUS_USERID    ((uid_t)-2)
+#define RPC_MACHINE_CRED_USERID         ((uid_t)0)
-#define RPC_ANONYMOUS_GROUPID   ((gid_t)-2)
+#define RPC_MACHINE_CRED_GROUPID        ((gid_t)0)
 struct generic_cred {
        struct rpc_cred gc_base;
@@ -44,8 +44,8 @@ EXPORT_SYMBOL_GPL(rpc_lookup_cred);
 struct rpc_cred *rpc_lookup_machine_cred(void)
 {
        struct auth_cred acred = {
-                .uid = RPC_ANONYMOUS_USERID,
+                .uid = RPC_MACHINE_CRED_USERID,
-                .gid = RPC_ANONYMOUS_GROUPID,
+                .gid = RPC_MACHINE_CRED_GROUPID,
                .machine_cred = 1,
        };
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index d8e8d79a8451..e46c825f4954 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -6,30 +6,9 @@
 #include <linux/sched.h>
 #include <linux/errno.h>
-#include <linux/fcntl.h>
-#include <linux/net.h>
-#include <linux/in.h>
-#include <linux/inet.h>
-#include <linux/udp.h>
-#include <linux/tcp.h>
-#include <linux/unistd.h>
-#include <linux/slab.h>
-#include <linux/netdevice.h>
-#include <linux/skbuff.h>
-#include <linux/file.h>
 #include <linux/freezer.h>
 #include <linux/kthread.h>
 #include <net/sock.h>
-#include <net/checksum.h>
-#include <net/ip.h>
-#include <net/ipv6.h>
-#include <net/tcp_states.h>
-#include <linux/uaccess.h>
-#include <asm/ioctls.h>
-#include <linux/sunrpc/types.h>
-#include <linux/sunrpc/clnt.h>
-#include <linux/sunrpc/xdr.h>
 #include <linux/sunrpc/stats.h>
 #include <linux/sunrpc/svc_xprt.h>
@@ -296,8 +275,6 @@ void svc_xprt_enqueue(struct svc_xprt *xprt)
        if (!(xprt->xpt_flags &
              ((1<<XPT_CONN)|(1<<XPT_DATA)|(1<<XPT_CLOSE)|(1<<XPT_DEFERRED))))
                return;
-        if (test_bit(XPT_DEAD, &xprt->xpt_flags))
-                return;
        cpu = get_cpu();
        pool = svc_pool_for_cpu(xprt->xpt_server, cpu);
diff --git a/net/sunrpc/svcauth_unix.c b/net/sunrpc/svcauth_unix.c
index 3f30ee6006ae..f24800f2c098 100644
--- a/net/sunrpc/svcauth_unix.c
+++ b/net/sunrpc/svcauth_unix.c
@@ -278,7 +278,7 @@ static int ip_map_show(struct seq_file *m,
                dom = im->m_client->h.name;
        if (ipv6_addr_v4mapped(&addr)) {
-                seq_printf(m, "%s" NIPQUAD_FMT "%s\n",
+                seq_printf(m, "%s " NIPQUAD_FMT " %s\n",
                        im->m_class,
                        ntohl(addr.s6_addr32[3]) >> 24 & 0xff,
                        ntohl(addr.s6_addr32[3]) >> 16 & 0xff,
@@ -286,7 +286,7 @@ static int ip_map_show(struct seq_file *m,
                        ntohl(addr.s6_addr32[3]) >>  0 & 0xff,
                        dom);
        } else {
-                seq_printf(m, "%s" NIP6_FMT "%s\n",
+                seq_printf(m, "%s " NIP6_FMT " %s\n",
                        im->m_class, NIP6(addr), dom);
        }
        return 0;
diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
index c22d6b6f2db4..06ab4841537b 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
@@ -260,11 +260,16 @@ static int rdma_read_max_sge(struct svcxprt_rdma *xprt, int sge_count)
 * On our side, we need to read into a pagelist. The first page immediately
 * follows the RPC header.
 *
- * This function returns 1 to indicate success. The data is not yet in
+ * This function returns:
+ * 0 - No error and no read-list found.
+ *
+ * 1 - Successful read-list processing. The data is not yet in
 * the pagelist and therefore the RPC request must be deferred. The
 * I/O completion will enqueue the transport again and
 * svc_rdma_recvfrom will complete the request.
 *
+ * <0 - Error processing/posting read-list.
+ *
 * NOTE: The ctxt must not be touched after the last WR has been posted
 * because the I/O completion processing may occur on another
 * processor and free / modify the context. Ne touche pas!
@@ -284,7 +289,6 @@ static int rdma_read_xdr(struct svcxprt_rdma *xprt,
        u64 sgl_offset;
        struct rpcrdma_read_chunk *ch;
        struct svc_rdma_op_ctxt *ctxt = NULL;
-        struct svc_rdma_op_ctxt *head;
        struct svc_rdma_op_ctxt *tmp_sge_ctxt;
        struct svc_rdma_op_ctxt *tmp_ch_ctxt;
        struct chunk_sge *ch_sge_ary;
@@ -302,25 +306,19 @@ static int rdma_read_xdr(struct svcxprt_rdma *xprt,
        ch_sge_ary = (struct chunk_sge *)tmp_ch_ctxt->sge;
        svc_rdma_rcl_chunk_counts(ch, &ch_count, &byte_count);
+        if (ch_count > RPCSVC_MAXPAGES)
+                return -EINVAL;
        sge_count = rdma_rcl_to_sge(xprt, rqstp, hdr_ctxt, rmsgp,
                                    sge, ch_sge_ary,
                                    ch_count, byte_count);
-        head = svc_rdma_get_context(xprt);
        sgl_offset = 0;
        ch_no = 0;
        for (ch = (struct rpcrdma_read_chunk *)&rmsgp->rm_body.rm_chunks[0];
             ch->rc_discrim != 0; ch++, ch_no++) {
 next_sge:
-                if (!ctxt)
+                ctxt = svc_rdma_get_context(xprt);
-                        ctxt = head;
-                else {
-                        ctxt->next = svc_rdma_get_context(xprt);
-                        ctxt = ctxt->next;
-                }
-                ctxt->next = NULL;
                ctxt->direction = DMA_FROM_DEVICE;
-                clear_bit(RDMACTXT_F_READ_DONE, &ctxt->flags);
                clear_bit(RDMACTXT_F_LAST_CTXT, &ctxt->flags);
                /* Prepare READ WR */
@@ -347,20 +345,15 @@ next_sge:
                         * the client and the RPC needs to be enqueued.
                         */
                        set_bit(RDMACTXT_F_LAST_CTXT, &ctxt->flags);
-                        ctxt->next = hdr_ctxt;
+                        ctxt->read_hdr = hdr_ctxt;
-                        hdr_ctxt->next = head;
                }
                /* Post the read */
                err = svc_rdma_send(xprt, &read_wr);
                if (err) {
-                        printk(KERN_ERR "svcrdma: Error posting send = %d\n",
+                        printk(KERN_ERR "svcrdma: Error %d posting RDMA_READ\n",
                               err);
-                        /*
+                        set_bit(XPT_CLOSE, &xprt->sc_xprt.xpt_flags);
-                         * Break the circular list so free knows when
+                        svc_rdma_put_context(ctxt, 0);
-                         * to stop if the error happened to occur on
-                         * the last read
-                         */
-                        ctxt->next = NULL;
                        goto out;
                }
                atomic_inc(&rdma_stat_read);
@@ -371,7 +364,7 @@ next_sge:
                        goto next_sge;
                }
                sgl_offset = 0;
-                err = 0;
+                err = 1;
        }
 out:
@@ -389,25 +382,12 @@ next_sge:
        while (rqstp->rq_resused)
                rqstp->rq_respages[--rqstp->rq_resused] = NULL;
-        if (err) {
+        return err;
-                printk(KERN_ERR "svcrdma : RDMA_READ error = %d\n", err);
-                set_bit(XPT_CLOSE, &xprt->sc_xprt.xpt_flags);
-                /* Free the linked list of read contexts */
-                while (head != NULL) {
-                        ctxt = head->next;
-                        svc_rdma_put_context(head, 1);
-                        head = ctxt;
-                }
-                return 0;
-        }
-        return 1;
 }
 static int rdma_read_complete(struct svc_rqst *rqstp,
-                              struct svc_rdma_op_ctxt *data)
+                              struct svc_rdma_op_ctxt *head)
 {
-        struct svc_rdma_op_ctxt *head = data->next;
        int page_no;
        int ret;
@@ -433,21 +413,12 @@ static int rdma_read_complete(struct svc_rqst *rqstp,
        rqstp->rq_arg.len = head->arg.len;
        rqstp->rq_arg.buflen = head->arg.buflen;
+        /* Free the context */
+        svc_rdma_put_context(head, 0);
        /* XXX: What should this be? */
        rqstp->rq_prot = IPPROTO_MAX;
+        svc_xprt_copy_addrs(rqstp, rqstp->rq_xprt);
-        /*
-         * Free the contexts we used to build the RDMA_READ. We have
-         * to be careful here because the context list uses the same
-         * next pointer used to chain the contexts associated with the
-         * RDMA_READ
-         */
-        data->next = NULL;      /* terminate circular list */
-        do {
-                data = head->next;
-                svc_rdma_put_context(head, 0);
-                head = data;
-        } while (head != NULL);
        ret = rqstp->rq_arg.head[0].iov_len
                + rqstp->rq_arg.page_len
@@ -457,8 +428,6 @@ static int rdma_read_complete(struct svc_rqst *rqstp,
                ret, rqstp->rq_arg.len, rqstp->rq_arg.head[0].iov_base,
                rqstp->rq_arg.head[0].iov_len);
-        /* Indicate that we've consumed an RQ credit */
-        rqstp->rq_xprt_ctxt = rqstp->rq_xprt;
        svc_xprt_received(rqstp->rq_xprt);
        return ret;
 }
@@ -480,13 +449,6 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp)
        dprintk("svcrdma: rqstp=%p\n", rqstp);
-        /*
-         * The rq_xprt_ctxt indicates if we've consumed an RQ credit
-         * or not. It is used in the rdma xpo_release_rqst function to
-         * determine whether or not to return an RQ WQE to the RQ.
-         */
-        rqstp->rq_xprt_ctxt = NULL;
        spin_lock_bh(&rdma_xprt->sc_read_complete_lock);
        if (!list_empty(&rdma_xprt->sc_read_complete_q)) {
                ctxt = list_entry(rdma_xprt->sc_read_complete_q.next,
@@ -537,21 +499,22 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp)
        /* If the request is invalid, reply with an error */
        if (len < 0) {
                if (len == -ENOSYS)
-                        (void)svc_rdma_send_error(rdma_xprt, rmsgp, ERR_VERS);
+                        svc_rdma_send_error(rdma_xprt, rmsgp, ERR_VERS);
                goto close_out;
        }
-        /* Read read-list data. If we would need to wait, defer
+        /* Read read-list data. */
-         * it. Not that in this case, we don't return the RQ credit
+        ret = rdma_read_xdr(rdma_xprt, rmsgp, rqstp, ctxt);
-         * until after the read completes.
+        if (ret > 0) {
-         */
+                /* read-list posted, defer until data received from client. */
-        if (rdma_read_xdr(rdma_xprt, rmsgp, rqstp, ctxt)) {
                svc_xprt_received(xprt);
                return 0;
        }
+        if (ret < 0) {
-        /* Indicate we've consumed an RQ credit */
+                /* Post of read-list failed, free context. */
-        rqstp->rq_xprt_ctxt = rqstp->rq_xprt;
+                svc_rdma_put_context(ctxt, 1);
+                return 0;
+        }
        ret = rqstp->rq_arg.head[0].iov_len
                + rqstp->rq_arg.page_len
@@ -569,11 +532,8 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp)
        return ret;
 close_out:
-        if (ctxt) {
+        if (ctxt)
                svc_rdma_put_context(ctxt, 1);
-                /* Indicate we've consumed an RQ credit */
-                rqstp->rq_xprt_ctxt = rqstp->rq_xprt;
-        }
        dprintk("svcrdma: transport %p is closing\n", xprt);
        /*
         * Set the close bit and enqueue it. svc_recv will see the
diff --git a/net/sunrpc/xprtrdma/svc_rdma_sendto.c b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
index 981f190c1b39..fb82b1b683f8 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
@@ -389,6 +389,17 @@ static int send_reply(struct svcxprt_rdma *rdma,
        int page_no;
        int ret;
+        /* Post a recv buffer to handle another request. */
+        ret = svc_rdma_post_recv(rdma);
+        if (ret) {
+                printk(KERN_INFO
+                       "svcrdma: could not post a receive buffer, err=%d."
+                       "Closing transport %p.\n", ret, rdma);
+                set_bit(XPT_CLOSE, &rdma->sc_xprt.xpt_flags);
+                svc_rdma_put_context(ctxt, 0);
+                return -ENOTCONN;
+        }
        /* Prepare the context */
        ctxt->pages[0] = page;
        ctxt->count = 1;
diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
index af408fc12634..e132509d1db0 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -103,8 +103,8 @@ static int rdma_bump_context_cache(struct svcxprt_rdma *xprt)
                spin_lock_bh(&xprt->sc_ctxt_lock);
                if (ctxt) {
                        at_least_one = 1;
-                        ctxt->next = xprt->sc_ctxt_head;
+                        INIT_LIST_HEAD(&ctxt->free_list);
-                        xprt->sc_ctxt_head = ctxt;
+                        list_add(&ctxt->free_list, &xprt->sc_ctxt_free);
                } else {
                        /* kmalloc failed...give up for now */
                        xprt->sc_ctxt_cnt--;
@@ -123,7 +123,7 @@ struct svc_rdma_op_ctxt *svc_rdma_get_context(struct svcxprt_rdma *xprt)
        while (1) {
                spin_lock_bh(&xprt->sc_ctxt_lock);
-                if (unlikely(xprt->sc_ctxt_head == NULL)) {
+                if (unlikely(list_empty(&xprt->sc_ctxt_free))) {
                        /* Try to bump my cache. */
                        spin_unlock_bh(&xprt->sc_ctxt_lock);
@@ -136,12 +136,15 @@ struct svc_rdma_op_ctxt *svc_rdma_get_context(struct svcxprt_rdma *xprt)
                        schedule_timeout_uninterruptible(msecs_to_jiffies(500));
                        continue;
                }
-                ctxt = xprt->sc_ctxt_head;
+                ctxt = list_entry(xprt->sc_ctxt_free.next,
-                xprt->sc_ctxt_head = ctxt->next;
+                                  struct svc_rdma_op_ctxt,
+                                  free_list);
+                list_del_init(&ctxt->free_list);
                spin_unlock_bh(&xprt->sc_ctxt_lock);
                ctxt->xprt = xprt;
                INIT_LIST_HEAD(&ctxt->dto_q);
                ctxt->count = 0;
+                atomic_inc(&xprt->sc_ctxt_used);
                break;
        }
        return ctxt;
@@ -159,14 +162,15 @@ void svc_rdma_put_context(struct svc_rdma_op_ctxt *ctxt, int free_pages)
                        put_page(ctxt->pages[i]);
        for (i = 0; i < ctxt->count; i++)
-                dma_unmap_single(xprt->sc_cm_id->device->dma_device,
+                ib_dma_unmap_single(xprt->sc_cm_id->device,
-                                 ctxt->sge[i].addr,
+                                    ctxt->sge[i].addr,
-                                 ctxt->sge[i].length,
+                                    ctxt->sge[i].length,
-                                 ctxt->direction);
+                                    ctxt->direction);
        spin_lock_bh(&xprt->sc_ctxt_lock);
-        ctxt->next = xprt->sc_ctxt_head;
+        list_add(&ctxt->free_list, &xprt->sc_ctxt_free);
-        xprt->sc_ctxt_head = ctxt;
        spin_unlock_bh(&xprt->sc_ctxt_lock);
+        atomic_dec(&xprt->sc_ctxt_used);
 }
 /* ib_cq event handler */
@@ -228,23 +232,8 @@ static void dto_tasklet_func(unsigned long data)
                list_del_init(&xprt->sc_dto_q);
                spin_unlock_irqrestore(&dto_lock, flags);
-                if (test_and_clear_bit(RDMAXPRT_RQ_PENDING, &xprt->sc_flags)) {
+                rq_cq_reap(xprt);
-                        ib_req_notify_cq(xprt->sc_rq_cq, IB_CQ_NEXT_COMP);
+                sq_cq_reap(xprt);
-                        rq_cq_reap(xprt);
-                        set_bit(XPT_DATA, &xprt->sc_xprt.xpt_flags);
-                        /*
-                         * If data arrived before established event,
-                         * don't enqueue. This defers RPC I/O until the
-                         * RDMA connection is complete.
-                         */
-                        if (!test_bit(RDMAXPRT_CONN_PENDING, &xprt->sc_flags))
-                                svc_xprt_enqueue(&xprt->sc_xprt);
-                }
-                if (test_and_clear_bit(RDMAXPRT_SQ_PENDING, &xprt->sc_flags)) {
-                        ib_req_notify_cq(xprt->sc_sq_cq, IB_CQ_NEXT_COMP);
-                        sq_cq_reap(xprt);
-                }
                svc_xprt_put(&xprt->sc_xprt);
                spin_lock_irqsave(&dto_lock, flags);
@@ -263,11 +252,15 @@ static void rq_comp_handler(struct ib_cq *cq, void *cq_context)
        struct svcxprt_rdma *xprt = cq_context;
        unsigned long flags;
+        /* Guard against unconditional flush call for destroyed QP */
+        if (atomic_read(&xprt->sc_xprt.xpt_ref.refcount)==0)
+                return;
        /*
         * Set the bit regardless of whether or not it's on the list
         * because it may be on the list already due to an SQ
         * completion.
-        */
+         */
        set_bit(RDMAXPRT_RQ_PENDING, &xprt->sc_flags);
        /*
@@ -290,6 +283,8 @@ static void rq_comp_handler(struct ib_cq *cq, void *cq_context)
 *
 * Take all completing WC off the CQE and enqueue the associated DTO
 * context on the dto_q for the transport.
+ *
+ * Note that caller must hold a transport reference.
 */
 static void rq_cq_reap(struct svcxprt_rdma *xprt)
 {
@@ -297,29 +292,47 @@ static void rq_cq_reap(struct svcxprt_rdma *xprt)
        struct ib_wc wc;
        struct svc_rdma_op_ctxt *ctxt = NULL;
+        if (!test_and_clear_bit(RDMAXPRT_RQ_PENDING, &xprt->sc_flags))
+                return;
+        ib_req_notify_cq(xprt->sc_rq_cq, IB_CQ_NEXT_COMP);
        atomic_inc(&rdma_stat_rq_poll);
-        spin_lock_bh(&xprt->sc_rq_dto_lock);
        while ((ret = ib_poll_cq(xprt->sc_rq_cq, 1, &wc)) > 0) {
                ctxt = (struct svc_rdma_op_ctxt *)(unsigned long)wc.wr_id;
                ctxt->wc_status = wc.status;
                ctxt->byte_len = wc.byte_len;
                if (wc.status != IB_WC_SUCCESS) {
                        /* Close the transport */
+                        dprintk("svcrdma: transport closing putting ctxt %p\n", ctxt);
                        set_bit(XPT_CLOSE, &xprt->sc_xprt.xpt_flags);
                        svc_rdma_put_context(ctxt, 1);
+                        svc_xprt_put(&xprt->sc_xprt);
                        continue;
                }
+                spin_lock_bh(&xprt->sc_rq_dto_lock);
                list_add_tail(&ctxt->dto_q, &xprt->sc_rq_dto_q);
+                spin_unlock_bh(&xprt->sc_rq_dto_lock);
+                svc_xprt_put(&xprt->sc_xprt);
        }
-        spin_unlock_bh(&xprt->sc_rq_dto_lock);
        if (ctxt)
                atomic_inc(&rdma_stat_rq_prod);
+        set_bit(XPT_DATA, &xprt->sc_xprt.xpt_flags);
+        /*
+         * If data arrived before established event,
+         * don't enqueue. This defers RPC I/O until the
+         * RDMA connection is complete.
+         */
+        if (!test_bit(RDMAXPRT_CONN_PENDING, &xprt->sc_flags))
+                svc_xprt_enqueue(&xprt->sc_xprt);
 }
 /*
 * Send Queue Completion Handler - potentially called on interrupt context.
+ *
+ * Note that caller must hold a transport reference.
 */
 static void sq_cq_reap(struct svcxprt_rdma *xprt)
 {
@@ -328,6 +341,11 @@ static void sq_cq_reap(struct svcxprt_rdma *xprt)
        struct ib_cq *cq = xprt->sc_sq_cq;
        int ret;
+        if (!test_and_clear_bit(RDMAXPRT_SQ_PENDING, &xprt->sc_flags))
+                return;
+        ib_req_notify_cq(xprt->sc_sq_cq, IB_CQ_NEXT_COMP);
        atomic_inc(&rdma_stat_sq_poll);
        while ((ret = ib_poll_cq(cq, 1, &wc)) > 0) {
                ctxt = (struct svc_rdma_op_ctxt *)(unsigned long)wc.wr_id;
@@ -349,14 +367,16 @@ static void sq_cq_reap(struct svcxprt_rdma *xprt)
                case IB_WR_RDMA_READ:
                        if (test_bit(RDMACTXT_F_LAST_CTXT, &ctxt->flags)) {
+                                struct svc_rdma_op_ctxt *read_hdr = ctxt->read_hdr;
+                                BUG_ON(!read_hdr);
                                set_bit(XPT_DATA, &xprt->sc_xprt.xpt_flags);
-                                set_bit(RDMACTXT_F_READ_DONE, &ctxt->flags);
                                spin_lock_bh(&xprt->sc_read_complete_lock);
-                                list_add_tail(&ctxt->dto_q,
+                                list_add_tail(&read_hdr->dto_q,
                                              &xprt->sc_read_complete_q);
                                spin_unlock_bh(&xprt->sc_read_complete_lock);
                                svc_xprt_enqueue(&xprt->sc_xprt);
                        }
+                        svc_rdma_put_context(ctxt, 0);
                        break;
                default:
@@ -365,6 +385,7 @@ static void sq_cq_reap(struct svcxprt_rdma *xprt)
                               wc.opcode, wc.status);
                        break;
                }
+                svc_xprt_put(&xprt->sc_xprt);
        }
        if (ctxt)
@@ -376,11 +397,15 @@ static void sq_comp_handler(struct ib_cq *cq, void *cq_context)
        struct svcxprt_rdma *xprt = cq_context;
        unsigned long flags;
+        /* Guard against unconditional flush call for destroyed QP */
+        if (atomic_read(&xprt->sc_xprt.xpt_ref.refcount)==0)
+                return;
        /*
         * Set the bit regardless of whether or not it's on the list
         * because it may be on the list already due to an RQ
         * completion.
-        */
+         */
        set_bit(RDMAXPRT_SQ_PENDING, &xprt->sc_flags);
        /*
@@ -407,28 +432,29 @@ static void create_context_cache(struct svcxprt_rdma *xprt,
        xprt->sc_ctxt_max = ctxt_max;
        xprt->sc_ctxt_bump = ctxt_bump;
        xprt->sc_ctxt_cnt = 0;
-        xprt->sc_ctxt_head = NULL;
+        atomic_set(&xprt->sc_ctxt_used, 0);
+        INIT_LIST_HEAD(&xprt->sc_ctxt_free);
        for (i = 0; i < ctxt_count; i++) {
                ctxt = kmalloc(sizeof(*ctxt), GFP_KERNEL);
                if (ctxt) {
-                        ctxt->next = xprt->sc_ctxt_head;
+                        INIT_LIST_HEAD(&ctxt->free_list);
-                        xprt->sc_ctxt_head = ctxt;
+                        list_add(&ctxt->free_list, &xprt->sc_ctxt_free);
                        xprt->sc_ctxt_cnt++;
                }
        }
 }
-static void destroy_context_cache(struct svc_rdma_op_ctxt *ctxt)
+static void destroy_context_cache(struct svcxprt_rdma *xprt)
 {
-        struct svc_rdma_op_ctxt *next;
+        while (!list_empty(&xprt->sc_ctxt_free)) {
-        if (!ctxt)
+                struct svc_rdma_op_ctxt *ctxt;
-                return;
+                ctxt = list_entry(xprt->sc_ctxt_free.next,
+                                  struct svc_rdma_op_ctxt,
-        do {
+                                  free_list);
-                next = ctxt->next;
+                list_del_init(&ctxt->free_list);
                kfree(ctxt);
-                ctxt = next;
+        }
-        } while (next);
 }
 static struct svcxprt_rdma *rdma_create_xprt(struct svc_serv *serv,
@@ -465,7 +491,7 @@ static struct svcxprt_rdma *rdma_create_xprt(struct svc_serv *serv,
                                     reqs +
                                     cma_xprt->sc_sq_depth +
                                     RPCRDMA_MAX_THREADS + 1); /* max */
-                if (!cma_xprt->sc_ctxt_head) {
+                if (list_empty(&cma_xprt->sc_ctxt_free)) {
                        kfree(cma_xprt);
                        return NULL;
                }
@@ -520,7 +546,12 @@ int svc_rdma_post_recv(struct svcxprt_rdma *xprt)
        recv_wr.num_sge = ctxt->count;
        recv_wr.wr_id = (u64)(unsigned long)ctxt;
+        svc_xprt_get(&xprt->sc_xprt);
        ret = ib_post_recv(xprt->sc_qp, &recv_wr, &bad_recv_wr);
+        if (ret) {
+                svc_xprt_put(&xprt->sc_xprt);
+                svc_rdma_put_context(ctxt, 1);
+        }
        return ret;
 }
@@ -539,6 +570,7 @@ static void handle_connect_req(struct rdma_cm_id *new_cma_id)
 {
        struct svcxprt_rdma *listen_xprt = new_cma_id->context;
        struct svcxprt_rdma *newxprt;
+        struct sockaddr *sa;
        /* Create a new transport */
        newxprt = rdma_create_xprt(listen_xprt->sc_xprt.xpt_server, 0);
@@ -551,6 +583,12 @@ static void handle_connect_req(struct rdma_cm_id *new_cma_id)
        dprintk("svcrdma: Creating newxprt=%p, cm_id=%p, listenxprt=%p\n",
                newxprt, newxprt->sc_cm_id, listen_xprt);
+        /* Set the local and remote addresses in the transport */
+        sa = (struct sockaddr *)&newxprt->sc_cm_id->route.addr.dst_addr;
+        svc_xprt_set_remote(&newxprt->sc_xprt, sa, svc_addr_len(sa));
+        sa = (struct sockaddr *)&newxprt->sc_cm_id->route.addr.src_addr;
+        svc_xprt_set_local(&newxprt->sc_xprt, sa, svc_addr_len(sa));
        /*
         * Enqueue the new transport on the accept queue of the listening
         * transport
@@ -627,6 +665,7 @@ static int rdma_cma_handler(struct rdma_cm_id *cma_id,
                if (xprt) {
                        set_bit(XPT_CLOSE, &xprt->xpt_flags);
                        svc_xprt_enqueue(xprt);
+                        svc_xprt_put(xprt);
                }
                break;
        case RDMA_CM_EVENT_DEVICE_REMOVAL:
@@ -661,31 +700,27 @@ static struct svc_xprt *svc_rdma_create(struct svc_serv *serv,
        cma_xprt = rdma_create_xprt(serv, 1);
        if (!cma_xprt)
-                return ERR_PTR(ENOMEM);
+                return ERR_PTR(-ENOMEM);
        xprt = &cma_xprt->sc_xprt;
        listen_id = rdma_create_id(rdma_listen_handler, cma_xprt, RDMA_PS_TCP);
        if (IS_ERR(listen_id)) {
-                svc_xprt_put(&cma_xprt->sc_xprt);
+                ret = PTR_ERR(listen_id);
-                dprintk("svcrdma: rdma_create_id failed = %ld\n",
+                dprintk("svcrdma: rdma_create_id failed = %d\n", ret);
-                        PTR_ERR(listen_id));
+                goto err0;
-                return (void *)listen_id;
        }
        ret = rdma_bind_addr(listen_id, sa);
        if (ret) {
-                rdma_destroy_id(listen_id);
-                svc_xprt_put(&cma_xprt->sc_xprt);
                dprintk("svcrdma: rdma_bind_addr failed = %d\n", ret);
-                return ERR_PTR(ret);
+                goto err1;
        }
        cma_xprt->sc_cm_id = listen_id;
        ret = rdma_listen(listen_id, RPCRDMA_LISTEN_BACKLOG);
        if (ret) {
-                rdma_destroy_id(listen_id);
-                svc_xprt_put(&cma_xprt->sc_xprt);
                dprintk("svcrdma: rdma_listen failed = %d\n", ret);
-                return ERR_PTR(ret);
+                goto err1;
        }
        /*
@@ -696,6 +731,12 @@ static struct svc_xprt *svc_rdma_create(struct svc_serv *serv,
        svc_xprt_set_local(&cma_xprt->sc_xprt, sa, salen);
        return &cma_xprt->sc_xprt;
+ err1:
+        rdma_destroy_id(listen_id);
+ err0:
+        kfree(cma_xprt);
+        return ERR_PTR(ret);
 }
 /*
@@ -716,7 +757,6 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
        struct rdma_conn_param conn_param;
        struct ib_qp_init_attr qp_attr;
        struct ib_device_attr devattr;
-        struct sockaddr *sa;
        int ret;
        int i;
@@ -826,7 +866,6 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
                newxprt->sc_sq_depth = qp_attr.cap.max_send_wr;
                newxprt->sc_max_requests = qp_attr.cap.max_recv_wr;
        }
-        svc_xprt_get(&newxprt->sc_xprt);
        newxprt->sc_qp = newxprt->sc_cm_id->qp;
        /* Register all of physical memory */
@@ -850,6 +889,13 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
        /* Swap out the handler */
        newxprt->sc_cm_id->event_handler = rdma_cma_handler;
+        /*
+         * Arm the CQs for the SQ and RQ before accepting so we can't
+         * miss the first message
+         */
+        ib_req_notify_cq(newxprt->sc_sq_cq, IB_CQ_NEXT_COMP);
+        ib_req_notify_cq(newxprt->sc_rq_cq, IB_CQ_NEXT_COMP);
        /* Accept Connection */
        set_bit(RDMAXPRT_CONN_PENDING, &newxprt->sc_flags);
        memset(&conn_param, 0, sizeof conn_param);
@@ -886,58 +932,26 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
                newxprt->sc_max_requests,
                newxprt->sc_ord);
-        /* Set the local and remote addresses in the transport */
-        sa = (struct sockaddr *)&newxprt->sc_cm_id->route.addr.dst_addr;
-        svc_xprt_set_remote(&newxprt->sc_xprt, sa, svc_addr_len(sa));
-        sa = (struct sockaddr *)&newxprt->sc_cm_id->route.addr.src_addr;
-        svc_xprt_set_local(&newxprt->sc_xprt, sa, svc_addr_len(sa));
-        ib_req_notify_cq(newxprt->sc_sq_cq, IB_CQ_NEXT_COMP);
-        ib_req_notify_cq(newxprt->sc_rq_cq, IB_CQ_NEXT_COMP);
        return &newxprt->sc_xprt;
 errout:
        dprintk("svcrdma: failure accepting new connection rc=%d.\n", ret);
        /* Take a reference in case the DTO handler runs */
        svc_xprt_get(&newxprt->sc_xprt);
-        if (newxprt->sc_qp && !IS_ERR(newxprt->sc_qp)) {
+        if (newxprt->sc_qp && !IS_ERR(newxprt->sc_qp))
                ib_destroy_qp(newxprt->sc_qp);
-                svc_xprt_put(&newxprt->sc_xprt);
-        }
        rdma_destroy_id(newxprt->sc_cm_id);
        /* This call to put will destroy the transport */
        svc_xprt_put(&newxprt->sc_xprt);
        return NULL;
 }
-/*
- * Post an RQ WQE to the RQ when the rqst is being released. This
- * effectively returns an RQ credit to the client. The rq_xprt_ctxt
- * will be null if the request is deferred due to an RDMA_READ or the
- * transport had no data ready (EAGAIN). Note that an RPC deferred in
- * svc_process will still return the credit, this is because the data
- * is copied and no longer consume a WQE/WC.
- */
 static void svc_rdma_release_rqst(struct svc_rqst *rqstp)
 {
-        int err;
-        struct svcxprt_rdma *rdma =
-                container_of(rqstp->rq_xprt, struct svcxprt_rdma, sc_xprt);
-        if (rqstp->rq_xprt_ctxt) {
-                BUG_ON(rqstp->rq_xprt_ctxt != rdma);
-                err = svc_rdma_post_recv(rdma);
-                if (err)
-                        dprintk("svcrdma: failed to post an RQ WQE error=%d\n",
-                                err);
-        }
-        rqstp->rq_xprt_ctxt = NULL;
 }
 /*
- * When connected, an svc_xprt has at least three references:
+ * When connected, an svc_xprt has at least two references:
- *
- * - A reference held by the QP. We still hold that here because this
- *   code deletes the QP and puts the reference.
 *
 * - A reference held by the cm_id between the ESTABLISHED and
 *   DISCONNECTED events. If the remote peer disconnected first, this
@@ -946,7 +960,7 @@ static void svc_rdma_release_rqst(struct svc_rqst *rqstp)
 * - A reference held by the svc_recv code that called this function
 *   as part of close processing.
 *
- * At a minimum two references should still be held.
+ * At a minimum one references should still be held.
 */
 static void svc_rdma_detach(struct svc_xprt *xprt)
 {
@@ -956,23 +970,53 @@ static void svc_rdma_detach(struct svc_xprt *xprt)
        /* Disconnect and flush posted WQE */
        rdma_disconnect(rdma->sc_cm_id);
-        /* Destroy the QP if present (not a listener) */
-        if (rdma->sc_qp && !IS_ERR(rdma->sc_qp)) {
-                ib_destroy_qp(rdma->sc_qp);
-                svc_xprt_put(xprt);
-        }
-        /* Destroy the CM ID */
-        rdma_destroy_id(rdma->sc_cm_id);
 }
-static void svc_rdma_free(struct svc_xprt *xprt)
+static void __svc_rdma_free(struct work_struct *work)
 {
-        struct svcxprt_rdma *rdma = (struct svcxprt_rdma *)xprt;
+        struct svcxprt_rdma *rdma =
+                container_of(work, struct svcxprt_rdma, sc_work);
        dprintk("svcrdma: svc_rdma_free(%p)\n", rdma);
        /* We should only be called from kref_put */
-        BUG_ON(atomic_read(&xprt->xpt_ref.refcount) != 0);
+        BUG_ON(atomic_read(&rdma->sc_xprt.xpt_ref.refcount) != 0);
+        /*
+         * Destroy queued, but not processed read completions. Note
+         * that this cleanup has to be done before destroying the
+         * cm_id because the device ptr is needed to unmap the dma in
+         * svc_rdma_put_context.
+         */
+        spin_lock_bh(&rdma->sc_read_complete_lock);
+        while (!list_empty(&rdma->sc_read_complete_q)) {
+                struct svc_rdma_op_ctxt *ctxt;
+                ctxt = list_entry(rdma->sc_read_complete_q.next,
+                                  struct svc_rdma_op_ctxt,
+                                  dto_q);
+                list_del_init(&ctxt->dto_q);
+                svc_rdma_put_context(ctxt, 1);
+        }
+        spin_unlock_bh(&rdma->sc_read_complete_lock);
+        /* Destroy queued, but not processed recv completions */
+        spin_lock_bh(&rdma->sc_rq_dto_lock);
+        while (!list_empty(&rdma->sc_rq_dto_q)) {
+                struct svc_rdma_op_ctxt *ctxt;
+                ctxt = list_entry(rdma->sc_rq_dto_q.next,
+                                  struct svc_rdma_op_ctxt,
+                                  dto_q);
+                list_del_init(&ctxt->dto_q);
+                svc_rdma_put_context(ctxt, 1);
+        }
+        spin_unlock_bh(&rdma->sc_rq_dto_lock);
+        /* Warn if we leaked a resource or under-referenced */
+        WARN_ON(atomic_read(&rdma->sc_ctxt_used) != 0);
+        /* Destroy the QP if present (not a listener) */
+        if (rdma->sc_qp && !IS_ERR(rdma->sc_qp))
+                ib_destroy_qp(rdma->sc_qp);
        if (rdma->sc_sq_cq && !IS_ERR(rdma->sc_sq_cq))
                ib_destroy_cq(rdma->sc_sq_cq);
@@ -985,10 +1029,21 @@ static void svc_rdma_free(struct svc_xprt *xprt)
        if (rdma->sc_pd && !IS_ERR(rdma->sc_pd))
                ib_dealloc_pd(rdma->sc_pd);
-        destroy_context_cache(rdma->sc_ctxt_head);
+        /* Destroy the CM ID */
+        rdma_destroy_id(rdma->sc_cm_id);
+        destroy_context_cache(rdma);
        kfree(rdma);
 }
+static void svc_rdma_free(struct svc_xprt *xprt)
+{
+        struct svcxprt_rdma *rdma =
+                container_of(xprt, struct svcxprt_rdma, sc_xprt);
+        INIT_WORK(&rdma->sc_work, __svc_rdma_free);
+        schedule_work(&rdma->sc_work);
+}
 static int svc_rdma_has_wspace(struct svc_xprt *xprt)
 {
        struct svcxprt_rdma *rdma =
@@ -1018,7 +1073,7 @@ int svc_rdma_send(struct svcxprt_rdma *xprt, struct ib_send_wr *wr)
        int ret;
        if (test_bit(XPT_CLOSE, &xprt->sc_xprt.xpt_flags))
-                return 0;
+                return -ENOTCONN;
        BUG_ON(wr->send_flags != IB_SEND_SIGNALED);
        BUG_ON(((struct svc_rdma_op_ctxt *)(unsigned long)wr->wr_id)->wr_op !=
@@ -1029,7 +1084,8 @@ int svc_rdma_send(struct svcxprt_rdma *xprt, struct ib_send_wr *wr)
                if (xprt->sc_sq_depth == atomic_read(&xprt->sc_sq_count)) {
                        spin_unlock_bh(&xprt->sc_lock);
                        atomic_inc(&rdma_stat_sq_starve);
-                        /* See if we can reap some SQ WR */
+                        /* See if we can opportunistically reap SQ WR to make room */
                        sq_cq_reap(xprt);
                        /* Wait until SQ WR available if SQ still full */
@@ -1041,22 +1097,25 @@ int svc_rdma_send(struct svcxprt_rdma *xprt, struct ib_send_wr *wr)
                        continue;
                }
                /* Bumped used SQ WR count and post */
+                svc_xprt_get(&xprt->sc_xprt);
                ret = ib_post_send(xprt->sc_qp, wr, &bad_wr);
                if (!ret)
                        atomic_inc(&xprt->sc_sq_count);
-                else
+                else {
+                        svc_xprt_put(&xprt->sc_xprt);
                        dprintk("svcrdma: failed to post SQ WR rc=%d, "
                               "sc_sq_count=%d, sc_sq_depth=%d\n",
                               ret, atomic_read(&xprt->sc_sq_count),
                               xprt->sc_sq_depth);
+                }
                spin_unlock_bh(&xprt->sc_lock);
                break;
        }
        return ret;
 }
-int svc_rdma_send_error(struct svcxprt_rdma *xprt, struct rpcrdma_msg *rmsgp,
+void svc_rdma_send_error(struct svcxprt_rdma *xprt, struct rpcrdma_msg *rmsgp,
-                        enum rpcrdma_errcode err)
+                         enum rpcrdma_errcode err)
 {
        struct ib_send_wr err_wr;
        struct ib_sge sge;
@@ -1094,9 +1153,8 @@ int svc_rdma_send_error(struct svcxprt_rdma *xprt, struct rpcrdma_msg *rmsgp,
        /* Post It */
        ret = svc_rdma_send(xprt, &err_wr);
        if (ret) {
-                dprintk("svcrdma: Error posting send = %d\n", ret);
+                dprintk("svcrdma: Error %d posting send for protocol error\n",
+                        ret);
                svc_rdma_put_context(ctxt, 1);
        }
-        return ret;
 }
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 2bdd4dddc0e1..fb75f265b39c 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -187,7 +187,8 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
        return genlmsg_end(msg, hdr);
 nla_put_failure:
-        return genlmsg_cancel(msg, hdr);
+        genlmsg_cancel(msg, hdr);
+        return -EMSGSIZE;
 }
 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
@@ -273,7 +274,8 @@ static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
        return genlmsg_end(msg, hdr);
 nla_put_failure:
-        return genlmsg_cancel(msg, hdr);
+        genlmsg_cancel(msg, hdr);
+        return -EMSGSIZE;
 }
 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
@@ -928,7 +930,8 @@ static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
        return genlmsg_end(msg, hdr);
 nla_put_failure:
-        return genlmsg_cancel(msg, hdr);
+        genlmsg_cancel(msg, hdr);
+        return -EMSGSIZE;
 }
 static int nl80211_dump_station(struct sk_buff *skb,
@@ -1267,7 +1270,8 @@ static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
        return genlmsg_end(msg, hdr);
 nla_put_failure:
-        return genlmsg_cancel(msg, hdr);
+        genlmsg_cancel(msg, hdr);
+        return -EMSGSIZE;
 }
 static int nl80211_dump_mpath(struct sk_buff *skb,
diff --git a/net/xfrm/xfrm_algo.c b/net/xfrm/xfrm_algo.c
index ac765dd9c7f5..23a2cc04b8cd 100644
--- a/net/xfrm/xfrm_algo.c
+++ b/net/xfrm/xfrm_algo.c
@@ -200,8 +200,8 @@ static struct xfrm_algo_desc aalg_list[] = {
        }
 },
 {
-        .name = "hmac(ripemd160)",
+        .name = "hmac(rmd160)",
-        .compat = "ripemd160",
+        .compat = "rmd160",
        .uinfo = {
                .auth = {
author	David S. Miller <davem@davemloft.net>	2008-06-10 05:22:26 -0400
committer	David S. Miller <davem@davemloft.net>	2008-06-10 05:22:26 -0400
commit	65b53e4cc90e59936733b3b95b9451d2ca47528d (patch)
tree	29932718192962671c48c3fd1ea017a6112459e8 /net
parent	788c0a53164c05c5ccdb1472474372b72ba74644 (diff)
parent	2e761e0532a784816e7e822dbaaece8c5d4be14d (diff)