Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6 into fixes

56 files changed, 564 insertions, 440 deletions

diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index 4dd873e3a1bb..be1cb909d8c0 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -42,6 +42,8 @@
 #include <net/9p/client.h>
 #include <net/9p/transport.h>
 
+#include <linux/syscalls.h> /* killme */
+
 #define P9_PORT 564
 #define MAX_SOCK_BUF (64*1024)
 #define MAXPOLLWADDR    2
@@ -788,24 +790,41 @@ static int p9_fd_open(struct p9_client *client, int rfd, int wfd)
 
 static int p9_socket_open(struct p9_client *client, struct socket *csocket)
 {
-        int fd, ret;
+        struct p9_trans_fd *p;
+        int ret, fd;
+
+        p = kmalloc(sizeof(struct p9_trans_fd), GFP_KERNEL);
+        if (!p)
+                return -ENOMEM;
 
         csocket->sk->sk_allocation = GFP_NOIO;
         fd = sock_map_fd(csocket, 0);
         if (fd < 0) {
                 P9_EPRINTK(KERN_ERR, "p9_socket_open: failed to map fd\n");
+                sock_release(csocket);
+                kfree(p);
                 return fd;
         }
 
-        ret = p9_fd_open(client, fd, fd);
-        if (ret < 0) {
-                P9_EPRINTK(KERN_ERR, "p9_socket_open: failed to open fd\n");
+        get_file(csocket->file);
+        get_file(csocket->file);
+        p->wr = p->rd = csocket->file;
+        client->trans = p;
+        client->status = Connected;
+
+        sys_close(fd);  /* still racy */
+
+        p->rd->f_flags |= O_NONBLOCK;
+
+        p->conn = p9_conn_create(client);
+        if (IS_ERR(p->conn)) {
+                ret = PTR_ERR(p->conn);
+                p->conn = NULL;
+                kfree(p);
+                sockfd_put(csocket);
                 sockfd_put(csocket);
                 return ret;
         }
-
-        ((struct p9_trans_fd *)client->trans)->rd->f_flags |= O_NONBLOCK;
-
         return 0;
 }
 
@@ -883,7 +902,6 @@ p9_fd_create_tcp(struct p9_client *client, const char *addr, char *args)
         struct socket *csocket;
         struct sockaddr_in sin_server;
         struct p9_fd_opts opts;
-        struct p9_trans_fd *p = NULL; /* this gets allocated in p9_fd_open */
 
         err = parse_opts(args, &opts);
         if (err < 0)
@@ -897,12 +915,11 @@ p9_fd_create_tcp(struct p9_client *client, const char *addr, char *args)
         sin_server.sin_family = AF_INET;
         sin_server.sin_addr.s_addr = in_aton(addr);
         sin_server.sin_port = htons(opts.port);
-        sock_create_kern(PF_INET, SOCK_STREAM, IPPROTO_TCP, &csocket);
+        err = sock_create_kern(PF_INET, SOCK_STREAM, IPPROTO_TCP, &csocket);
 
-        if (!csocket) {
+        if (err) {
                 P9_EPRINTK(KERN_ERR, "p9_trans_tcp: problem creating socket\n");
-                err = -EIO;
-                goto error;
+                return err;
         }
 
         err = csocket->ops->connect(csocket,
@@ -912,30 +929,11 @@ p9_fd_create_tcp(struct p9_client *client, const char *addr, char *args)
                 P9_EPRINTK(KERN_ERR,
                         "p9_trans_tcp: problem connecting socket to %s\n",
                         addr);
-                goto error;
-        }
-
-        err = p9_socket_open(client, csocket);
-        if (err < 0)
-                goto error;
-
-        p = (struct p9_trans_fd *) client->trans;
-        p->conn = p9_conn_create(client);
-        if (IS_ERR(p->conn)) {
-                err = PTR_ERR(p->conn);
-                p->conn = NULL;
-                goto error;
-        }
-
-        return 0;
-
-error:
-        if (csocket)
                 sock_release(csocket);
+                return err;
+        }
 
-        kfree(p);
-
-        return err;
+        return p9_socket_open(client, csocket);
 }
 
 static int
@@ -944,49 +942,33 @@ p9_fd_create_unix(struct p9_client *client, const char *addr, char *args)
         int err;
         struct socket *csocket;
         struct sockaddr_un sun_server;
-        struct p9_trans_fd *p = NULL; /* this gets allocated in p9_fd_open */
 
         csocket = NULL;
 
         if (strlen(addr) > UNIX_PATH_MAX) {
                 P9_EPRINTK(KERN_ERR, "p9_trans_unix: address too long: %s\n",
                         addr);
-                err = -ENAMETOOLONG;
-                goto error;
+                return -ENAMETOOLONG;
         }
 
         sun_server.sun_family = PF_UNIX;
         strcpy(sun_server.sun_path, addr);
-        sock_create_kern(PF_UNIX, SOCK_STREAM, 0, &csocket);
+        err = sock_create_kern(PF_UNIX, SOCK_STREAM, 0, &csocket);
+        if (err < 0) {
+                P9_EPRINTK(KERN_ERR, "p9_trans_unix: problem creating socket\n");
+                return err;
+        }
         err = csocket->ops->connect(csocket, (struct sockaddr *)&sun_server,
                         sizeof(struct sockaddr_un) - 1, 0);
         if (err < 0) {
                 P9_EPRINTK(KERN_ERR,
                         "p9_trans_unix: problem connecting socket: %s: %d\n",
                         addr, err);
-                goto error;
-        }
-
-        err = p9_socket_open(client, csocket);
-        if (err < 0)
-                goto error;
-
-        p = (struct p9_trans_fd *) client->trans;
-        p->conn = p9_conn_create(client);
-        if (IS_ERR(p->conn)) {
-                err = PTR_ERR(p->conn);
-                p->conn = NULL;
-                goto error;
-        }
-
-        return 0;
-
-error:
-        if (csocket)
                 sock_release(csocket);
+                return err;
+        }
 
-        kfree(p);
-        return err;
+        return p9_socket_open(client, csocket);
 }
 
 static int
@@ -994,7 +976,7 @@ p9_fd_create(struct p9_client *client, const char *addr, char *args)
 {
         int err;
         struct p9_fd_opts opts;
-        struct p9_trans_fd *p = NULL; /* this get allocated in p9_fd_open */
+        struct p9_trans_fd *p;
 
         parse_opts(args, &opts);
 
@@ -1005,21 +987,19 @@ p9_fd_create(struct p9_client *client, const char *addr, char *args)
 
         err = p9_fd_open(client, opts.rfd, opts.wfd);
         if (err < 0)
-                goto error;
+                return err;
 
         p = (struct p9_trans_fd *) client->trans;
         p->conn = p9_conn_create(client);
         if (IS_ERR(p->conn)) {
                 err = PTR_ERR(p->conn);
                 p->conn = NULL;
-                goto error;
+                fput(p->rd);
+                fput(p->wr);
+                return err;
         }
 
         return 0;
-
-error:
-        kfree(p);
-        return err;
 }
 
 static struct p9_trans_module p9_tcp_trans = {
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 569750010fd3..18e7f5a43dc4 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -770,7 +770,7 @@ static int hidp_setup_hid(struct hidp_session *session,
 
         hid = hid_allocate_device();
         if (IS_ERR(hid))
-                return PTR_ERR(session->hid);
+                return PTR_ERR(hid);
 
         session->hid = hid;
         session->req = req;
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 5129b88c8e5b..1120cf14a548 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -1212,6 +1212,7 @@ static void l2cap_monitor_timeout(unsigned long arg)
         bh_lock_sock(sk);
         if (l2cap_pi(sk)->retry_count >= l2cap_pi(sk)->remote_max_tx) {
                 l2cap_send_disconn_req(l2cap_pi(sk)->conn, sk);
+                bh_unlock_sock(sk);
                 return;
         }
 
@@ -3435,8 +3436,8 @@ static inline int l2cap_data_channel_sframe(struct sock *sk, u16 rx_control, str
                             (pi->unacked_frames > 0))
                                 __mod_retrans_timer();
 
-                        l2cap_ertm_send(sk);
                         pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
+                        l2cap_ertm_send(sk);
                 }
                 break;
 
@@ -3471,9 +3472,9 @@ static inline int l2cap_data_channel_sframe(struct sock *sk, u16 rx_control, str
                 pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
 
                 if (rx_control & L2CAP_CTRL_POLL) {
-                        l2cap_retransmit_frame(sk, tx_seq);
                         pi->expected_ack_seq = tx_seq;
                         l2cap_drop_acked_frames(sk);
+                        l2cap_retransmit_frame(sk, tx_seq);
                         l2cap_ertm_send(sk);
                         if (pi->conn_state & L2CAP_CONN_WAIT_F) {
                                 pi->srej_save_reqseq = tx_seq;
diff --git a/net/core/dev.c b/net/core/dev.c
index 6fe7d739e59b..be9924f60ec3 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -5035,6 +5035,11 @@ int register_netdevice(struct net_device *dev)
                 rollback_registered(dev);
                 dev->reg_state = NETREG_UNREGISTERED;
         }
+        /*
+         *      Prevent userspace races by waiting until the network
+         *      device is fully setup before sending notifications.
+         */
+        rtmsg_ifinfo(RTM_NEWLINK, dev, ~0U);
 
 out:
         return ret;
@@ -5597,6 +5602,12 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char
         /* Notify protocols, that a new device appeared. */
         call_netdevice_notifiers(NETDEV_REGISTER, dev);
 
+        /*
+         *      Prevent userspace races by waiting until the network
+         *      device is fully setup before sending notifications.
+         */
+        rtmsg_ifinfo(RTM_NEWLINK, dev, ~0U);
+
         synchronize_net();
         err = 0;
 out:
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index a23b45f08ec9..de0c2c726420 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -250,8 +250,7 @@ struct pktgen_dev {
         __u64 count;            /* Default No packets to send */
         __u64 sofar;            /* How many pkts we've sent so far */
         __u64 tx_bytes;         /* How many bytes we've transmitted */
-        __u64 errors;           /* Errors when trying to transmit,
-                                   pkts will be re-sent */
+        __u64 errors;           /* Errors when trying to transmit, */
 
         /* runtime counters relating to clone_skb */
 
@@ -3465,6 +3464,12 @@ static void pktgen_xmit(struct pktgen_dev *pkt_dev)
                 pkt_dev->seq_num++;
                 pkt_dev->tx_bytes += pkt_dev->last_pkt_size;
                 break;
+        case NET_XMIT_DROP:
+        case NET_XMIT_CN:
+        case NET_XMIT_POLICED:
+                /* skb has been consumed */
+                pkt_dev->errors++;
+                break;
         default: /* Drivers are not supposed to return other values! */
                 if (net_ratelimit())
                         pr_info("pktgen: %s xmit error: %d\n",
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 33148a568199..794bcb897ff0 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1364,15 +1364,15 @@ static int rtnetlink_event(struct notifier_block *this, unsigned long event, voi
         case NETDEV_UNREGISTER:
                 rtmsg_ifinfo(RTM_DELLINK, dev, ~0U);
                 break;
-        case NETDEV_REGISTER:
-                rtmsg_ifinfo(RTM_NEWLINK, dev, ~0U);
-                break;
         case NETDEV_UP:
         case NETDEV_DOWN:
                 rtmsg_ifinfo(RTM_NEWLINK, dev, IFF_UP|IFF_RUNNING);
                 break;
+        case NETDEV_POST_INIT:
+        case NETDEV_REGISTER:
         case NETDEV_CHANGE:
         case NETDEV_GOING_DOWN:
+        case NETDEV_UNREGISTER_BATCH:
                 break;
         default:
                 rtmsg_ifinfo(RTM_NEWLINK, dev, 0);
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index bfa3e7865a8c..93c4e060c91e 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -93,7 +93,7 @@ static int sock_pipe_buf_steal(struct pipe_inode_info *pipe,
 
 
 /* Pipe buffer operations for a socket. */
-static struct pipe_buf_operations sock_pipe_buf_ops = {
+static const struct pipe_buf_operations sock_pipe_buf_ops = {
         .can_merge = 0,
         .map = generic_pipe_buf_map,
         .unmap = generic_pipe_buf_unmap,
diff --git a/net/dccp/probe.c b/net/dccp/probe.c
index dc328425fa20..a1362dc8abb0 100644
--- a/net/dccp/probe.c
+++ b/net/dccp/probe.c
@@ -43,7 +43,7 @@ static int bufsize = 64 * 1024;
 static const char procname[] = "dccpprobe";
 
 static struct {
-        struct kfifo      *fifo;
+        struct kfifo      fifo;
         spinlock_t        lock;
         wait_queue_head_t wait;
         struct timespec   tstart;
@@ -67,7 +67,7 @@ static void printl(const char *fmt, ...)
         len += vscnprintf(tbuf+len, sizeof(tbuf)-len, fmt, args);
         va_end(args);
 
-        kfifo_put(dccpw.fifo, tbuf, len);
+        kfifo_in_locked(&dccpw.fifo, tbuf, len, &dccpw.lock);
         wake_up(&dccpw.wait);
 }
 
@@ -109,7 +109,7 @@ static struct jprobe dccp_send_probe = {
 
 static int dccpprobe_open(struct inode *inode, struct file *file)
 {
-        kfifo_reset(dccpw.fifo);
+        kfifo_reset(&dccpw.fifo);
         getnstimeofday(&dccpw.tstart);
         return 0;
 }
@@ -131,11 +131,11 @@ static ssize_t dccpprobe_read(struct file *file, char __user *buf,
                 return -ENOMEM;
 
         error = wait_event_interruptible(dccpw.wait,
-                                         __kfifo_len(dccpw.fifo) != 0);
+                                         kfifo_len(&dccpw.fifo) != 0);
         if (error)
                 goto out_free;
 
-        cnt = kfifo_get(dccpw.fifo, tbuf, len);
+        cnt = kfifo_out_locked(&dccpw.fifo, tbuf, len, &dccpw.lock);
         error = copy_to_user(buf, tbuf, cnt) ? -EFAULT : 0;
 
 out_free:
@@ -156,10 +156,8 @@ static __init int dccpprobe_init(void)
 
         init_waitqueue_head(&dccpw.wait);
         spin_lock_init(&dccpw.lock);
-        dccpw.fifo = kfifo_alloc(bufsize, GFP_KERNEL, &dccpw.lock);
-        if (IS_ERR(dccpw.fifo))
-                return PTR_ERR(dccpw.fifo);
-
+        if (kfifo_alloc(&dccpw.fifo, bufsize, GFP_KERNEL))
+                return ret;
         if (!proc_net_fops_create(&init_net, procname, S_IRUSR, &dccpprobe_fops))
                 goto err0;
 
@@ -172,14 +170,14 @@ static __init int dccpprobe_init(void)
 err1:
         proc_net_remove(&init_net, procname);
 err0:
-        kfifo_free(dccpw.fifo);
+        kfifo_free(&dccpw.fifo);
         return ret;
 }
 module_init(dccpprobe_init);
 
 static __exit void dccpprobe_exit(void)
 {
-        kfifo_free(dccpw.fifo);
+        kfifo_free(&dccpw.fifo);
         proc_net_remove(&init_net, procname);
         unregister_jprobe(&dccp_send_probe);
 
diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index 70491d9035eb..0c94a1ac2946 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -166,7 +166,7 @@ config IP_PNP_DHCP
 
           If unsure, say Y. Note that if you want to use DHCP, a DHCP server
           must be operating on your network.  Read
-          <file:Documentation/filesystems/nfsroot.txt> for details.
+          <file:Documentation/filesystems/nfs/nfsroot.txt> for details.
 
 config IP_PNP_BOOTP
         bool "IP: BOOTP support"
@@ -181,7 +181,7 @@ config IP_PNP_BOOTP
           does BOOTP itself, providing all necessary information on the kernel
           command line, you can say N here. If unsure, say Y. Note that if you
           want to use BOOTP, a BOOTP server must be operating on your network.
-          Read <file:Documentation/filesystems/nfsroot.txt> for details.
+          Read <file:Documentation/filesystems/nfs/nfsroot.txt> for details.
 
 config IP_PNP_RARP
         bool "IP: RARP support"
@@ -194,7 +194,7 @@ config IP_PNP_RARP
           older protocol which is being obsoleted by BOOTP and DHCP), say Y
           here. Note that if you want to use RARP, a RARP server must be
           operating on your network. Read
-          <file:Documentation/filesystems/nfsroot.txt> for details.
+          <file:Documentation/filesystems/nfs/nfsroot.txt> for details.
 
 # not yet ready..
 #   bool '    IP: ARP support' CONFIG_IP_PNP_ARP
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 5cdbc102a418..040c4f05b653 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1397,6 +1397,7 @@ static struct devinet_sysctl_table {
                 DEVINET_SYSCTL_RW_ENTRY(ACCEPT_SOURCE_ROUTE,
                                         "accept_source_route"),
                 DEVINET_SYSCTL_RW_ENTRY(ACCEPT_LOCAL, "accept_local"),
+                DEVINET_SYSCTL_RW_ENTRY(SRC_VMARK, "src_valid_mark"),
                 DEVINET_SYSCTL_RW_ENTRY(PROXY_ARP, "proxy_arp"),
                 DEVINET_SYSCTL_RW_ENTRY(MEDIUM_ID, "medium_id"),
                 DEVINET_SYSCTL_RW_ENTRY(BOOTP_RELAY, "bootp_relay"),
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 3323168ee52d..82dbf711d6d0 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -252,6 +252,8 @@ int fib_validate_source(__be32 src, __be32 dst, u8 tos, int oif,
                 no_addr = in_dev->ifa_list == NULL;
                 rpf = IN_DEV_RPFILTER(in_dev);
                 accept_local = IN_DEV_ACCEPT_LOCAL(in_dev);
+                if (mark && !IN_DEV_SRC_VMARK(in_dev))
+                        fl.mark = 0;
         }
         rcu_read_unlock();
 
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index 4e08b7f2331c..10a6a604bf32 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -1446,7 +1446,7 @@ late_initcall(ip_auto_config);
 
 /*
  *  Decode any IP configuration options in the "ip=" or "nfsaddrs=" kernel
- *  command line parameter.  See Documentation/filesystems/nfsroot.txt.
+ *  command line parameter.  See Documentation/filesystems/nfs/nfsroot.txt.
  */
 static int __init ic_proto_name(char *name)
 {
diff --git a/net/ipv4/netfilter/nf_defrag_ipv4.c b/net/ipv4/netfilter/nf_defrag_ipv4.c
index fa2d6b6fc3e5..331ead3ebd1b 100644
--- a/net/ipv4/netfilter/nf_defrag_ipv4.c
+++ b/net/ipv4/netfilter/nf_defrag_ipv4.c
@@ -14,6 +14,7 @@
 #include <net/route.h>
 #include <net/ip.h>
 
+#include <linux/netfilter_bridge.h>
 #include <linux/netfilter_ipv4.h>
 #include <net/netfilter/ipv4/nf_defrag_ipv4.h>
 
@@ -34,6 +35,20 @@ static int nf_ct_ipv4_gather_frags(struct sk_buff *skb, u_int32_t user)
         return err;
 }
 
+static enum ip_defrag_users nf_ct_defrag_user(unsigned int hooknum,
+                                              struct sk_buff *skb)
+{
+#ifdef CONFIG_BRIDGE_NETFILTER
+        if (skb->nf_bridge &&
+            skb->nf_bridge->mask & BRNF_NF_BRIDGE_PREROUTING)
+                return IP_DEFRAG_CONNTRACK_BRIDGE_IN;
+#endif
+        if (hooknum == NF_INET_PRE_ROUTING)
+                return IP_DEFRAG_CONNTRACK_IN;
+        else
+                return IP_DEFRAG_CONNTRACK_OUT;
+}
+
 static unsigned int ipv4_conntrack_defrag(unsigned int hooknum,
                                           struct sk_buff *skb,
                                           const struct net_device *in,
@@ -50,10 +65,8 @@ static unsigned int ipv4_conntrack_defrag(unsigned int hooknum,
 #endif
         /* Gather fragments. */
         if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) {
-                if (nf_ct_ipv4_gather_frags(skb,
-                                            hooknum == NF_INET_PRE_ROUTING ?
-                                            IP_DEFRAG_CONNTRACK_IN :
-                                            IP_DEFRAG_CONNTRACK_OUT))
+                enum ip_defrag_users user = nf_ct_defrag_user(hooknum, skb);
+                if (nf_ct_ipv4_gather_frags(skb, user))
                         return NF_STOLEN;
         }
         return NF_ACCEPT;
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 26399ad2a289..66fd80ef2473 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -277,6 +277,13 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
 
         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESRECV);
 
+        /* check for timestamp cookie support */
+        memset(&tcp_opt, 0, sizeof(tcp_opt));
+        tcp_parse_options(skb, &tcp_opt, &hash_location, 0);
+
+        if (tcp_opt.saw_tstamp)
+                cookie_check_timestamp(&tcp_opt);
+
         ret = NULL;
         req = inet_reqsk_alloc(&tcp_request_sock_ops); /* for safety */
         if (!req)
@@ -292,6 +299,12 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
         ireq->loc_addr          = ip_hdr(skb)->daddr;
         ireq->rmt_addr          = ip_hdr(skb)->saddr;
         ireq->ecn_ok            = 0;
+        ireq->snd_wscale        = tcp_opt.snd_wscale;
+        ireq->rcv_wscale        = tcp_opt.rcv_wscale;
+        ireq->sack_ok           = tcp_opt.sack_ok;
+        ireq->wscale_ok         = tcp_opt.wscale_ok;
+        ireq->tstamp_ok         = tcp_opt.saw_tstamp;
+        req->ts_recent          = tcp_opt.saw_tstamp ? tcp_opt.rcv_tsval : 0;
 
         /* We throwed the options of the initial SYN away, so we hope
          * the ACK carries the same options again (see RFC1122 4.2.3.8)
@@ -340,20 +353,6 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
                 }
         }
 
-        /* check for timestamp cookie support */
-        memset(&tcp_opt, 0, sizeof(tcp_opt));
-        tcp_parse_options(skb, &tcp_opt, &hash_location, 0, &rt->u.dst);
-
-        if (tcp_opt.saw_tstamp)
-                cookie_check_timestamp(&tcp_opt);
-
-        ireq->snd_wscale        = tcp_opt.snd_wscale;
-        ireq->rcv_wscale        = tcp_opt.rcv_wscale;
-        ireq->sack_ok           = tcp_opt.sack_ok;
-        ireq->wscale_ok         = tcp_opt.wscale_ok;
-        ireq->tstamp_ok         = tcp_opt.saw_tstamp;
-        req->ts_recent          = tcp_opt.saw_tstamp ? tcp_opt.rcv_tsval : 0;
-
         /* Try to redo what tcp_v4_send_synack did. */
         req->window_clamp = tp->window_clamp ? :dst_metric(&rt->u.dst, RTAX_WINDOW);
 
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 12cab7d74dba..28e029632493 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -3727,7 +3727,7 @@ old_ack:
  * the fast version below fails.
  */
 void tcp_parse_options(struct sk_buff *skb, struct tcp_options_received *opt_rx,
-                       u8 **hvpp, int estab,  struct dst_entry *dst)
+                       u8 **hvpp, int estab)
 {
         unsigned char *ptr;
         struct tcphdr *th = tcp_hdr(skb);
@@ -3766,8 +3766,7 @@ void tcp_parse_options(struct sk_buff *skb, struct tcp_options_received *opt_rx,
                                 break;
                         case TCPOPT_WINDOW:
                                 if (opsize == TCPOLEN_WINDOW && th->syn &&
-                                    !estab && sysctl_tcp_window_scaling &&
-                                    !dst_feature(dst, RTAX_FEATURE_NO_WSCALE)) {
+                                    !estab && sysctl_tcp_window_scaling) {
                                         __u8 snd_wscale = *(__u8 *)ptr;
                                         opt_rx->wscale_ok = 1;
                                         if (snd_wscale > 14) {
@@ -3783,8 +3782,7 @@ void tcp_parse_options(struct sk_buff *skb, struct tcp_options_received *opt_rx,
                         case TCPOPT_TIMESTAMP:
                                 if ((opsize == TCPOLEN_TIMESTAMP) &&
                                     ((estab && opt_rx->tstamp_ok) ||
-                                     (!estab && sysctl_tcp_timestamps &&
-                                      !dst_feature(dst, RTAX_FEATURE_NO_TSTAMP)))) {
+                                     (!estab && sysctl_tcp_timestamps))) {
                                         opt_rx->saw_tstamp = 1;
                                         opt_rx->rcv_tsval = get_unaligned_be32(ptr);
                                         opt_rx->rcv_tsecr = get_unaligned_be32(ptr + 4);
@@ -3792,8 +3790,7 @@ void tcp_parse_options(struct sk_buff *skb, struct tcp_options_received *opt_rx,
                                 break;
                         case TCPOPT_SACK_PERM:
                                 if (opsize == TCPOLEN_SACK_PERM && th->syn &&
-                                    !estab && sysctl_tcp_sack &&
-                                    !dst_feature(dst, RTAX_FEATURE_NO_SACK)) {
+                                    !estab && sysctl_tcp_sack) {
                                         opt_rx->sack_ok = 1;
                                         tcp_sack_reset(opt_rx);
                                 }
@@ -3878,7 +3875,7 @@ static int tcp_fast_parse_options(struct sk_buff *skb, struct tcphdr *th,
                 if (tcp_parse_aligned_timestamp(tp, th))
                         return 1;
         }
-        tcp_parse_options(skb, &tp->rx_opt, hvpp, 1, NULL);
+        tcp_parse_options(skb, &tp->rx_opt, hvpp, 1);
         return 1;
 }
 
@@ -4133,10 +4130,8 @@ static inline int tcp_sack_extend(struct tcp_sack_block *sp, u32 seq,
 static void tcp_dsack_set(struct sock *sk, u32 seq, u32 end_seq)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        struct dst_entry *dst = __sk_dst_get(sk);
 
-        if (tcp_is_sack(tp) && sysctl_tcp_dsack &&
-            !dst_feature(dst, RTAX_FEATURE_NO_DSACK)) {
+        if (tcp_is_sack(tp) && sysctl_tcp_dsack) {
                 int mib_idx;
 
                 if (before(seq, tp->rcv_nxt))
@@ -4165,15 +4160,13 @@ static void tcp_dsack_extend(struct sock *sk, u32 seq, u32 end_seq)
 static void tcp_send_dupack(struct sock *sk, struct sk_buff *skb)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        struct dst_entry *dst = __sk_dst_get(sk);
 
         if (TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(skb)->seq &&
             before(TCP_SKB_CB(skb)->seq, tp->rcv_nxt)) {
                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_DELAYEDACKLOST);
                 tcp_enter_quickack_mode(sk);
 
-                if (tcp_is_sack(tp) && sysctl_tcp_dsack &&
-                    !dst_feature(dst, RTAX_FEATURE_NO_DSACK)) {
+                if (tcp_is_sack(tp) && sysctl_tcp_dsack) {
                         u32 end_seq = TCP_SKB_CB(skb)->end_seq;
 
                         if (after(TCP_SKB_CB(skb)->end_seq, tp->rcv_nxt))
@@ -5428,11 +5421,10 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
         u8 *hash_location;
         struct inet_connection_sock *icsk = inet_csk(sk);
         struct tcp_sock *tp = tcp_sk(sk);
-        struct dst_entry *dst = __sk_dst_get(sk);
         struct tcp_cookie_values *cvp = tp->cookie_values;
         int saved_clamp = tp->rx_opt.mss_clamp;
 
-        tcp_parse_options(skb, &tp->rx_opt, &hash_location, 0, dst);
+        tcp_parse_options(skb, &tp->rx_opt, &hash_location, 0);
 
         if (th->ack) {
                 /* rfc793:
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 15e96030ce47..65b8ebfd078a 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1262,20 +1262,10 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         tcp_rsk(req)->af_specific = &tcp_request_sock_ipv4_ops;
 #endif
 
-        ireq = inet_rsk(req);
-        ireq->loc_addr = daddr;
-        ireq->rmt_addr = saddr;
-        ireq->no_srccheck = inet_sk(sk)->transparent;
-        ireq->opt = tcp_v4_save_options(sk, skb);
-
-        dst = inet_csk_route_req(sk, req);
-        if(!dst)
-                goto drop_and_free;
-
         tcp_clear_options(&tmp_opt);
         tmp_opt.mss_clamp = TCP_MSS_DEFAULT;
         tmp_opt.user_mss  = tp->rx_opt.user_mss;
-        tcp_parse_options(skb, &tmp_opt, &hash_location, 0, dst);
+        tcp_parse_options(skb, &tmp_opt, &hash_location, 0);
 
         if (tmp_opt.cookie_plus > 0 &&
             tmp_opt.saw_tstamp &&
@@ -1319,8 +1309,14 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
         tcp_openreq_init(req, &tmp_opt, skb);
 
+        ireq = inet_rsk(req);
+        ireq->loc_addr = daddr;
+        ireq->rmt_addr = saddr;
+        ireq->no_srccheck = inet_sk(sk)->transparent;
+        ireq->opt = tcp_v4_save_options(sk, skb);
+
         if (security_inet_conn_request(sk, skb, req))
-                goto drop_and_release;
+                goto drop_and_free;
 
         if (!want_cookie)
                 TCP_ECN_create_request(req, tcp_hdr(skb));
@@ -1345,6 +1341,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
                  */
                 if (tmp_opt.saw_tstamp &&
                     tcp_death_row.sysctl_tw_recycle &&
+                    (dst = inet_csk_route_req(sk, req)) != NULL &&
                     (peer = rt_get_peer((struct rtable *)dst)) != NULL &&
                     peer->v4daddr == saddr) {
                         if ((u32)get_seconds() - peer->tcp_ts_stamp < TCP_PAWS_MSL &&
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 87accec8d097..f206ee5dda80 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -95,9 +95,9 @@ tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
         struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
         int paws_reject = 0;
 
+        tmp_opt.saw_tstamp = 0;
         if (th->doff > (sizeof(*th) >> 2) && tcptw->tw_ts_recent_stamp) {
-                tmp_opt.tstamp_ok = 1;
-                tcp_parse_options(skb, &tmp_opt, &hash_location, 1, NULL);
+                tcp_parse_options(skb, &tmp_opt, &hash_location, 0);
 
                 if (tmp_opt.saw_tstamp) {
                         tmp_opt.ts_recent       = tcptw->tw_ts_recent;
@@ -526,9 +526,9 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
         __be32 flg = tcp_flag_word(th) & (TCP_FLAG_RST|TCP_FLAG_SYN|TCP_FLAG_ACK);
         int paws_reject = 0;
 
-        if ((th->doff > (sizeof(*th) >> 2)) && (req->ts_recent)) {
-                tmp_opt.tstamp_ok = 1;
-                tcp_parse_options(skb, &tmp_opt, &hash_location, 1, NULL);
+        tmp_opt.saw_tstamp = 0;
+        if (th->doff > (sizeof(struct tcphdr)>>2)) {
+                tcp_parse_options(skb, &tmp_opt, &hash_location, 0);
 
                 if (tmp_opt.saw_tstamp) {
                         tmp_opt.ts_recent = req->ts_recent;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 93316a96d820..383ce237640f 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -553,7 +553,6 @@ static unsigned tcp_syn_options(struct sock *sk, struct sk_buff *skb,
                                 struct tcp_md5sig_key **md5) {
         struct tcp_sock *tp = tcp_sk(sk);
         struct tcp_cookie_values *cvp = tp->cookie_values;
-        struct dst_entry *dst = __sk_dst_get(sk);
         unsigned remaining = MAX_TCP_OPTION_SPACE;
         u8 cookie_size = (!tp->rx_opt.cookie_out_never && cvp != NULL) ?
                          tcp_cookie_size_check(cvp->cookie_desired) :
@@ -581,22 +580,18 @@ static unsigned tcp_syn_options(struct sock *sk, struct sk_buff *skb,
         opts->mss = tcp_advertise_mss(sk);
         remaining -= TCPOLEN_MSS_ALIGNED;
 
-        if (likely(sysctl_tcp_timestamps &&
-                   !dst_feature(dst, RTAX_FEATURE_NO_TSTAMP) &&
-                   *md5 == NULL)) {
+        if (likely(sysctl_tcp_timestamps && *md5 == NULL)) {
                 opts->options |= OPTION_TS;
                 opts->tsval = TCP_SKB_CB(skb)->when;
                 opts->tsecr = tp->rx_opt.ts_recent;
                 remaining -= TCPOLEN_TSTAMP_ALIGNED;
         }
-        if (likely(sysctl_tcp_window_scaling &&
-                   !dst_feature(dst, RTAX_FEATURE_NO_WSCALE))) {
+        if (likely(sysctl_tcp_window_scaling)) {
                 opts->ws = tp->rx_opt.rcv_wscale;
                 opts->options |= OPTION_WSCALE;
                 remaining -= TCPOLEN_WSCALE_ALIGNED;
         }
-        if (likely(sysctl_tcp_sack &&
-                   !dst_feature(dst, RTAX_FEATURE_NO_SACK))) {
+        if (likely(sysctl_tcp_sack)) {
                 opts->options |= OPTION_SACK_ADVERTISE;
                 if (unlikely(!(OPTION_TS & opts->options)))
                         remaining -= TCPOLEN_SACKPERM_ALIGNED;
@@ -2527,9 +2522,7 @@ static void tcp_connect_init(struct sock *sk)
          * See tcp_input.c:tcp_rcv_state_process case TCP_SYN_SENT.
          */
         tp->tcp_header_len = sizeof(struct tcphdr) +
-                (sysctl_tcp_timestamps &&
-                (!dst_feature(dst, RTAX_FEATURE_NO_TSTAMP) ?
-                  TCPOLEN_TSTAMP_ALIGNED : 0));
+                (sysctl_tcp_timestamps ? TCPOLEN_TSTAMP_ALIGNED : 0);
 
 #ifdef CONFIG_TCP_MD5SIG
         if (tp->af_specific->md5_lookup(sk, sk) != NULL)
@@ -2555,8 +2548,7 @@ static void tcp_connect_init(struct sock *sk)
                                   tp->advmss - (tp->rx_opt.ts_recent_stamp ? tp->tcp_header_len - sizeof(struct tcphdr) : 0),
                                   &tp->rcv_wnd,
                                   &tp->window_clamp,
-                                  (sysctl_tcp_window_scaling &&
-                                   !dst_feature(dst, RTAX_FEATURE_NO_WSCALE)),
+                                  sysctl_tcp_window_scaling,
                                   &rcv_wscale);
 
         tp->rx_opt.rcv_wscale = rcv_wscale;
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 1f9534846ca9..f0126fdd7e04 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -216,9 +216,8 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum,
                  * force rand to be an odd multiple of UDP_HTABLE_SIZE
                  */
                 rand = (rand | 1) * (udptable->mask + 1);
-                for (last = first + udptable->mask + 1;
-                     first != last;
-                     first++) {
+                last = first + udptable->mask + 1;
+                do {
                         hslot = udp_hashslot(udptable, net, first);
                         bitmap_zero(bitmap, PORTS_PER_CHAIN);
                         spin_lock_bh(&hslot->lock);
@@ -238,7 +237,7 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum,
                                 snum += rand;
                         } while (snum != first);
                         spin_unlock_bh(&hslot->lock);
-                }
+                } while (++first != last);
                 goto fail;
         } else {
                 hslot = udp_hashslot(udptable, net, snum);
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
index 5f2ec208a8c3..0956ebabbff2 100644
--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
@@ -20,6 +20,7 @@
 #include <net/ipv6.h>
 #include <net/inet_frag.h>
 
+#include <linux/netfilter_bridge.h>
 #include <linux/netfilter_ipv6.h>
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_helper.h>
@@ -187,6 +188,21 @@ out:
         return nf_conntrack_confirm(skb);
 }
 
+static enum ip6_defrag_users nf_ct6_defrag_user(unsigned int hooknum,
+                                                struct sk_buff *skb)
+{
+#ifdef CONFIG_BRIDGE_NETFILTER
+        if (skb->nf_bridge &&
+            skb->nf_bridge->mask & BRNF_NF_BRIDGE_PREROUTING)
+                return IP6_DEFRAG_CONNTRACK_BRIDGE_IN;
+#endif
+        if (hooknum == NF_INET_PRE_ROUTING)
+                return IP6_DEFRAG_CONNTRACK_IN;
+        else
+                return IP6_DEFRAG_CONNTRACK_OUT;
+
+}
+
 static unsigned int ipv6_defrag(unsigned int hooknum,
                                 struct sk_buff *skb,
                                 const struct net_device *in,
@@ -199,8 +215,7 @@ static unsigned int ipv6_defrag(unsigned int hooknum,
         if (skb->nfct)
                 return NF_ACCEPT;
 
-        reasm = nf_ct_frag6_gather(skb);
-
+        reasm = nf_ct_frag6_gather(skb, nf_ct6_defrag_user(hooknum, skb));
         /* queued */
         if (reasm == NULL)
                 return NF_STOLEN;
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index e0b9424fa1b2..312c20adc83f 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -168,13 +168,14 @@ out:
 /* Creation primitives. */
 
 static __inline__ struct nf_ct_frag6_queue *
-fq_find(__be32 id, struct in6_addr *src, struct in6_addr *dst)
+fq_find(__be32 id, u32 user, struct in6_addr *src, struct in6_addr *dst)
 {
         struct inet_frag_queue *q;
         struct ip6_create_arg arg;
         unsigned int hash;
 
         arg.id = id;
+        arg.user = user;
         arg.src = src;
         arg.dst = dst;
 
@@ -559,7 +560,7 @@ find_prev_fhdr(struct sk_buff *skb, u8 *prevhdrp, int *prevhoff, int *fhoff)
         return 0;
 }
 
-struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb)
+struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb, u32 user)
 {
         struct sk_buff *clone;
         struct net_device *dev = skb->dev;
@@ -605,7 +606,7 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb)
         if (atomic_read(&nf_init_frags.mem) > nf_init_frags.high_thresh)
                 nf_ct_frag6_evictor();
 
-        fq = fq_find(fhdr->identification, &hdr->saddr, &hdr->daddr);
+        fq = fq_find(fhdr->identification, user, &hdr->saddr, &hdr->daddr);
         if (fq == NULL) {
                 pr_debug("Can't find and can't create new queue\n");
                 goto ret_orig;
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 4d98549a6868..2cddea3bd6be 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -72,6 +72,7 @@ struct frag_queue
         struct inet_frag_queue  q;
 
         __be32                  id;             /* fragment id          */
+        u32                     user;
         struct in6_addr         saddr;
         struct in6_addr         daddr;
 
@@ -141,7 +142,7 @@ int ip6_frag_match(struct inet_frag_queue *q, void *a)
         struct ip6_create_arg *arg = a;
 
         fq = container_of(q, struct frag_queue, q);
-        return (fq->id == arg->id &&
+        return (fq->id == arg->id && fq->user == arg->user &&
                         ipv6_addr_equal(&fq->saddr, arg->src) &&
                         ipv6_addr_equal(&fq->daddr, arg->dst));
 }
@@ -163,6 +164,7 @@ void ip6_frag_init(struct inet_frag_queue *q, void *a)
         struct ip6_create_arg *arg = a;
 
         fq->id = arg->id;
+        fq->user = arg->user;
         ipv6_addr_copy(&fq->saddr, arg->src);
         ipv6_addr_copy(&fq->daddr, arg->dst);
 }
@@ -243,6 +245,7 @@ fq_find(struct net *net, __be32 id, struct in6_addr *src, struct in6_addr *dst,
         unsigned int hash;
 
         arg.id = id;
+        arg.user = IP6_DEFRAG_LOCAL_DELIVER;
         arg.src = src;
         arg.dst = dst;
 
@@ -705,7 +708,8 @@ static void ip6_frags_ns_sysctl_unregister(struct net *net)
 
         table = net->ipv6.sysctl.frags_hdr->ctl_table_arg;
         unregister_net_sysctl_table(net->ipv6.sysctl.frags_hdr);
-        kfree(table);
+        if (!net_eq(net, &init_net))
+                kfree(table);
 }
 
 static struct ctl_table_header *ip6_ctl_header;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index db3b27303890..c2bd74c5f8d9 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2630,6 +2630,7 @@ struct ctl_table *ipv6_route_sysctl_init(struct net *net)
                 table[6].data = &net->ipv6.sysctl.ip6_rt_gc_elasticity;
                 table[7].data = &net->ipv6.sysctl.ip6_rt_mtu_expires;
                 table[8].data = &net->ipv6.sysctl.ip6_rt_min_advmss;
+                table[9].data = &net->ipv6.sysctl.ip6_rt_gc_min_interval;
         }
 
         return table;
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 5b9af508b8f2..7208a06576c6 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -185,6 +185,13 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
 
         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESRECV);
 
+        /* check for timestamp cookie support */
+        memset(&tcp_opt, 0, sizeof(tcp_opt));
+        tcp_parse_options(skb, &tcp_opt, &hash_location, 0);
+
+        if (tcp_opt.saw_tstamp)
+                cookie_check_timestamp(&tcp_opt);
+
         ret = NULL;
         req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
         if (!req)
@@ -218,6 +225,12 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
         req->expires = 0UL;
         req->retrans = 0;
         ireq->ecn_ok            = 0;
+        ireq->snd_wscale        = tcp_opt.snd_wscale;
+        ireq->rcv_wscale        = tcp_opt.rcv_wscale;
+        ireq->sack_ok           = tcp_opt.sack_ok;
+        ireq->wscale_ok         = tcp_opt.wscale_ok;
+        ireq->tstamp_ok         = tcp_opt.saw_tstamp;
+        req->ts_recent          = tcp_opt.saw_tstamp ? tcp_opt.rcv_tsval : 0;
         treq->rcv_isn = ntohl(th->seq) - 1;
         treq->snt_isn = cookie;
 
@@ -253,21 +266,6 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
                         goto out_free;
         }
 
-        /* check for timestamp cookie support */
-        memset(&tcp_opt, 0, sizeof(tcp_opt));
-        tcp_parse_options(skb, &tcp_opt, &hash_location, 0, dst);
-
-        if (tcp_opt.saw_tstamp)
-                cookie_check_timestamp(&tcp_opt);
-
-        req->ts_recent          = tcp_opt.saw_tstamp ? tcp_opt.rcv_tsval : 0;
-
-        ireq->snd_wscale        = tcp_opt.snd_wscale;
-        ireq->rcv_wscale        = tcp_opt.rcv_wscale;
-        ireq->sack_ok           = tcp_opt.sack_ok;
-        ireq->wscale_ok         = tcp_opt.wscale_ok;
-        ireq->tstamp_ok         = tcp_opt.saw_tstamp;
-
         req->window_clamp = tp->window_clamp ? :dst_metric(dst, RTAX_WINDOW);
         tcp_select_initial_window(tcp_full_space(sk), req->mss,
                                   &req->rcv_wnd, &req->window_clamp,
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index ee9cf62458d4..febfd595a40d 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1169,7 +1169,6 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         struct inet6_request_sock *treq;
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct tcp_sock *tp = tcp_sk(sk);
-        struct dst_entry *dst = __sk_dst_get(sk);
         __u32 isn = TCP_SKB_CB(skb)->when;
 #ifdef CONFIG_SYN_COOKIES
         int want_cookie = 0;
@@ -1208,7 +1207,7 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         tcp_clear_options(&tmp_opt);
         tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
         tmp_opt.user_mss = tp->rx_opt.user_mss;
-        tcp_parse_options(skb, &tmp_opt, &hash_location, 0, dst);
+        tcp_parse_options(skb, &tmp_opt, &hash_location, 0);
 
         if (tmp_opt.cookie_plus > 0 &&
             tmp_opt.saw_tstamp &&
diff --git a/net/irda/irnet/irnet.h b/net/irda/irnet/irnet.h
index b001c361ad30..4300df35d37d 100644
--- a/net/irda/irnet/irnet.h
+++ b/net/irda/irnet/irnet.h
@@ -249,6 +249,7 @@
 #include <linux/poll.h>
 #include <linux/capability.h>
 #include <linux/ctype.h>        /* isspace() */
+#include <linux/string.h>       /* skip_spaces() */
 #include <asm/uaccess.h>
 #include <linux/init.h>
 
diff --git a/net/irda/irnet/irnet_ppp.c b/net/irda/irnet/irnet_ppp.c
index 7dea882dbb75..156020d138b5 100644
--- a/net/irda/irnet/irnet_ppp.c
+++ b/net/irda/irnet/irnet_ppp.c
@@ -76,9 +76,8 @@ irnet_ctrl_write(irnet_socket *	ap,
       /* Look at the next command */
       start = next;
 
-      /* Scrap whitespaces before the command */
-      while(isspace(*start))
-        start++;
+        /* Scrap whitespaces before the command */
+        start = skip_spaces(start);
 
       /* ',' is our command separator */
       next = strchr(start, ',');
@@ -133,8 +132,7 @@ irnet_ctrl_write(irnet_socket *	ap,
               char *    endp;
 
               /* Scrap whitespaces before the command */
-              while(isspace(*begp))
-                begp++;
+              begp = skip_spaces(begp);
 
               /* Convert argument to a number (last arg is the base) */
               addr = simple_strtoul(begp, &endp, 16);
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index 1e428863574f..c18286a2167b 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -221,7 +221,7 @@ static int afiucv_pm_restore_thaw(struct device *dev)
         return 0;
 }
 
-static struct dev_pm_ops afiucv_pm_ops = {
+static const struct dev_pm_ops afiucv_pm_ops = {
         .prepare = afiucv_pm_prepare,
         .complete = afiucv_pm_complete,
         .freeze = afiucv_pm_freeze,
diff --git a/net/iucv/iucv.c b/net/iucv/iucv.c
index 3b1f5f5f8de7..fd8b28361a64 100644
--- a/net/iucv/iucv.c
+++ b/net/iucv/iucv.c
@@ -93,7 +93,7 @@ static int iucv_pm_freeze(struct device *);
 static int iucv_pm_thaw(struct device *);
 static int iucv_pm_restore(struct device *);
 
-static struct dev_pm_ops iucv_pm_ops = {
+static const struct dev_pm_ops iucv_pm_ops = {
         .prepare = iucv_pm_prepare,
         .complete = iucv_pm_complete,
         .freeze = iucv_pm_freeze,
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index 3787455fb696..d7dcee680728 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -34,9 +34,28 @@ void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_supported_band *sband,
 
         ht_cap->ht_supported = true;
 
-        ht_cap->cap = le16_to_cpu(ht_cap_ie->cap_info) & sband->ht_cap.cap;
-        ht_cap->cap &= ~IEEE80211_HT_CAP_SM_PS;
-        ht_cap->cap |= sband->ht_cap.cap & IEEE80211_HT_CAP_SM_PS;
+        /*
+         * The bits listed in this expression should be
+         * the same for the peer and us, if the station
+         * advertises more then we can't use those thus
+         * we mask them out.
+         */
+        ht_cap->cap = le16_to_cpu(ht_cap_ie->cap_info) &
+                (sband->ht_cap.cap |
+                 ~(IEEE80211_HT_CAP_LDPC_CODING |
+                   IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
+                   IEEE80211_HT_CAP_GRN_FLD |
+                   IEEE80211_HT_CAP_SGI_20 |
+                   IEEE80211_HT_CAP_SGI_40 |
+                   IEEE80211_HT_CAP_DSSSCCK40));
+        /*
+         * The STBC bits are asymmetric -- if we don't have
+         * TX then mask out the peer's RX and vice versa.
+         */
+        if (!(sband->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC))
+                ht_cap->cap &= ~IEEE80211_HT_CAP_RX_STBC;
+        if (!(sband->ht_cap.cap & IEEE80211_HT_CAP_RX_STBC))
+                ht_cap->cap &= ~IEEE80211_HT_CAP_TX_STBC;
 
         ampdu_info = ht_cap_ie->ampdu_params_info;
         ht_cap->ampdu_factor =
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 10d13856f86c..1f2db647bb5c 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -382,6 +382,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
 struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
                                         u8 *bssid,u8 *addr, u32 supp_rates)
 {
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
         int band = local->hw.conf.channel->band;
@@ -397,6 +398,9 @@ struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
                 return NULL;
         }
 
+        if (ifibss->state == IEEE80211_IBSS_MLME_SEARCH)
+                return NULL;
+
         if (compare_ether_addr(bssid, sdata->u.ibss.bssid))
                 return NULL;
 
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 8116d1a96a4a..0d2d94881f1f 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -515,6 +515,8 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
          * and we need some headroom for passing the frame to monitor
          * interfaces, but never both at the same time.
          */
+        BUILD_BUG_ON(IEEE80211_TX_STATUS_HEADROOM !=
+                        sizeof(struct ieee80211_tx_status_rtap_hdr));
         local->tx_headroom = max_t(unsigned int , local->hw.extra_tx_headroom,
                                    sizeof(struct ieee80211_tx_status_rtap_hdr));
 
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index d8d50fb5e823..c79e59f82fd9 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -915,6 +915,14 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
         sdata->u.mgd.flags &= ~(IEEE80211_STA_CONNECTION_POLL |
                                 IEEE80211_STA_BEACON_POLL);
 
+        /*
+         * Always handle WMM once after association regardless
+         * of the first value the AP uses. Setting -1 here has
+         * that effect because the AP values is an unsigned
+         * 4-bit value.
+         */
+        sdata->u.mgd.wmm_last_param_set = -1;
+
         ieee80211_led_assoc(local, 1);
 
         sdata->vif.bss_conf.assoc = 1;
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 8834cc93c716..27ceaefd7bc8 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1419,6 +1419,10 @@ static bool need_dynamic_ps(struct ieee80211_local *local)
         if (!local->ps_sdata)
                 return false;
 
+        /* No point if we're going to suspend */
+        if (local->quiescing)
+                return false;
+
         return true;
 }
 
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 78a6e924c7e1..dc76267e436e 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1039,7 +1039,19 @@ int ieee80211_reconfig(struct ieee80211_local *local)
 
         /* restart hardware */
         if (local->open_count) {
+                /*
+                 * Upon resume hardware can sometimes be goofy due to
+                 * various platform / driver / bus issues, so restarting
+                 * the device may at times not work immediately. Propagate
+                 * the error.
+                 */
                 res = drv_start(local);
+                if (res) {
+                        WARN(local->suspended, "Harware became unavailable "
+                             "upon resume. This is could be a software issue"
+                             "prior to suspend or a harware issue\n");
+                        return res;
+                }
 
                 ieee80211_led_radio(local, true);
         }
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index b95699f00545..847ffca40184 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -1366,6 +1366,7 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb,
                == sysctl_ip_vs_sync_threshold[0])) ||
              ((cp->protocol == IPPROTO_TCP) && (cp->old_state != cp->state) &&
               ((cp->state == IP_VS_TCP_S_FIN_WAIT) ||
+               (cp->state == IP_VS_TCP_S_CLOSE) ||
                (cp->state == IP_VS_TCP_S_CLOSE_WAIT) ||
                (cp->state == IP_VS_TCP_S_TIME_WAIT)))))
                 ip_vs_sync_conn(cp);
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index e55a6861d26f..6bde12da2fe0 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -2714,6 +2714,8 @@ static int ip_vs_genl_parse_service(struct ip_vs_service_user_kern *usvc,
         if (!(nla_af && (nla_fwmark || (nla_port && nla_protocol && nla_addr))))
                 return -EINVAL;
 
+        memset(usvc, 0, sizeof(*usvc));
+
         usvc->af = nla_get_u16(nla_af);
 #ifdef CONFIG_IP_VS_IPV6
         if (usvc->af != AF_INET && usvc->af != AF_INET6)
@@ -2901,6 +2903,8 @@ static int ip_vs_genl_parse_dest(struct ip_vs_dest_user_kern *udest,
         if (!(nla_addr && nla_port))
                 return -EINVAL;
 
+        memset(udest, 0, sizeof(*udest));
+
         nla_memcpy(&udest->addr, nla_addr, sizeof(udest->addr));
         udest->port = nla_get_u16(nla_port);
 
diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
index eb0ceb846527..fc70a49c0afd 100644
--- a/net/netfilter/xt_recent.c
+++ b/net/netfilter/xt_recent.c
@@ -482,8 +482,7 @@ static ssize_t recent_old_proc_write(struct file *file,
         if (copy_from_user(buf, input, size))
                 return -EFAULT;
 
-        while (isspace(*c))
-                c++;
+        c = skip_spaces(c);
 
         if (size - (c - buf) < 5)
                 return c - buf;
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 020562164b56..e0516a22be2e 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -415,7 +415,7 @@ static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
 {
         struct sock *sk = sock->sk;
         struct sockaddr_pkt *saddr = (struct sockaddr_pkt *)msg->msg_name;
-        struct sk_buff *skb;
+        struct sk_buff *skb = NULL;
         struct net_device *dev;
         __be16 proto = 0;
         int err;
@@ -437,6 +437,7 @@ static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
          */
 
         saddr->spkt_device[13] = 0;
+retry:
         rcu_read_lock();
         dev = dev_get_by_name_rcu(sock_net(sk), saddr->spkt_device);
         err = -ENODEV;
@@ -456,58 +457,48 @@ static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
         if (len > dev->mtu + dev->hard_header_len)
                 goto out_unlock;
 
-        err = -ENOBUFS;
-        skb = sock_wmalloc(sk, len + LL_RESERVED_SPACE(dev), 0, GFP_KERNEL);
-
-        /*
-         * If the write buffer is full, then tough. At this level the user
-         * gets to deal with the problem - do your own algorithmic backoffs.
-         * That's far more flexible.
-         */
-
-        if (skb == NULL)
-                goto out_unlock;
-
-        /*
-         *      Fill it in
-         */
-
-        /* FIXME: Save some space for broken drivers that write a
-         * hard header at transmission time by themselves. PPP is the
-         * notable one here. This should really be fixed at the driver level.
-         */
-        skb_reserve(skb, LL_RESERVED_SPACE(dev));
-        skb_reset_network_header(skb);
-
-        /* Try to align data part correctly */
-        if (dev->header_ops) {
-                skb->data -= dev->hard_header_len;
-                skb->tail -= dev->hard_header_len;
-                if (len < dev->hard_header_len)
-                        skb_reset_network_header(skb);
+        if (!skb) {
+                size_t reserved = LL_RESERVED_SPACE(dev);
+                unsigned int hhlen = dev->header_ops ? dev->hard_header_len : 0;
+
+                rcu_read_unlock();
+                skb = sock_wmalloc(sk, len + reserved, 0, GFP_KERNEL);
+                if (skb == NULL)
+                        return -ENOBUFS;
+                /* FIXME: Save some space for broken drivers that write a hard
+                 * header at transmission time by themselves. PPP is the notable
+                 * one here. This should really be fixed at the driver level.
+                 */
+                skb_reserve(skb, reserved);
+                skb_reset_network_header(skb);
+
+                /* Try to align data part correctly */
+                if (hhlen) {
+                        skb->data -= hhlen;
+                        skb->tail -= hhlen;
+                        if (len < hhlen)
+                                skb_reset_network_header(skb);
+                }
+                err = memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);
+                if (err)
+                        goto out_free;
+                goto retry;
         }
 
-        /* Returns -EFAULT on error */
-        err = memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);
+
         skb->protocol = proto;
         skb->dev = dev;
         skb->priority = sk->sk_priority;
         skb->mark = sk->sk_mark;
-        if (err)
-                goto out_free;
-
-        /*
-         *      Now send it
-         */
 
         dev_queue_xmit(skb);
         rcu_read_unlock();
         return len;
 
-out_free:
-        kfree_skb(skb);
 out_unlock:
         rcu_read_unlock();
+out_free:
+        kfree_skb(skb);
         return err;
 }
 
diff --git a/net/rds/ib.c b/net/rds/ib.c
index 536ebe5d3f6b..3b8992361042 100644
--- a/net/rds/ib.c
+++ b/net/rds/ib.c
@@ -182,8 +182,8 @@ static int rds_ib_conn_info_visitor(struct rds_connection *conn,
                 ic = conn->c_transport_data;
                 dev_addr = &ic->i_cm_id->route.addr.dev_addr;
 
-                ib_addr_get_sgid(dev_addr, (union ib_gid *) &iinfo->src_gid);
-                ib_addr_get_dgid(dev_addr, (union ib_gid *) &iinfo->dst_gid);
+                rdma_addr_get_sgid(dev_addr, (union ib_gid *) &iinfo->src_gid);
+                rdma_addr_get_dgid(dev_addr, (union ib_gid *) &iinfo->dst_gid);
 
                 rds_ibdev = ib_get_client_data(ic->i_cm_id->device, &rds_ib_client);
                 iinfo->max_send_wr = ic->i_send_ring.w_nr;
diff --git a/net/rds/iw.c b/net/rds/iw.c
index db224f7c2937..b28fa8525b24 100644
--- a/net/rds/iw.c
+++ b/net/rds/iw.c
@@ -184,8 +184,8 @@ static int rds_iw_conn_info_visitor(struct rds_connection *conn,
                 ic = conn->c_transport_data;
                 dev_addr = &ic->i_cm_id->route.addr.dev_addr;
 
-                ib_addr_get_sgid(dev_addr, (union ib_gid *) &iinfo->src_gid);
-                ib_addr_get_dgid(dev_addr, (union ib_gid *) &iinfo->dst_gid);
+                rdma_addr_get_sgid(dev_addr, (union ib_gid *) &iinfo->src_gid);
+                rdma_addr_get_dgid(dev_addr, (union ib_gid *) &iinfo->dst_gid);
 
                 rds_iwdev = ib_get_client_data(ic->i_cm_id->device, &rds_iw_client);
                 iinfo->max_send_wr = ic->i_send_ring.w_nr;
diff --git a/net/socket.c b/net/socket.c
index b94c3dd71015..769c386bd428 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -312,18 +312,6 @@ static struct file_system_type sock_fs_type = {
         .kill_sb =      kill_anon_super,
 };
 
-static int sockfs_delete_dentry(struct dentry *dentry)
-{
-        /*
-         * At creation time, we pretended this dentry was hashed
-         * (by clearing DCACHE_UNHASHED bit in d_flags)
-         * At delete time, we restore the truth : not hashed.
-         * (so that dput() can proceed correctly)
-         */
-        dentry->d_flags |= DCACHE_UNHASHED;
-        return 0;
-}
-
 /*
  * sockfs_dname() is called from d_path().
  */
@@ -334,7 +322,6 @@ static char *sockfs_dname(struct dentry *dentry, char *buffer, int buflen)
 }
 
 static const struct dentry_operations sockfs_dentry_operations = {
-        .d_delete = sockfs_delete_dentry,
         .d_dname  = sockfs_dname,
 };
 
@@ -355,68 +342,55 @@ static const struct dentry_operations sockfs_dentry_operations = {
  *      but we take care of internal coherence yet.
  */
 
-static int sock_alloc_fd(struct file **filep, int flags)
+static int sock_alloc_file(struct socket *sock, struct file **f, int flags)
 {
+        struct qstr name = { .name = "" };
+        struct path path;
+        struct file *file;
         int fd;
 
         fd = get_unused_fd_flags(flags);
-        if (likely(fd >= 0)) {
-                struct file *file = get_empty_filp();
-
-                *filep = file;
-                if (unlikely(!file)) {
-                        put_unused_fd(fd);
-                        return -ENFILE;
-                }
-        } else
-                *filep = NULL;
-        return fd;
-}
-
-static int sock_attach_fd(struct socket *sock, struct file *file, int flags)
-{
-        struct dentry *dentry;
-        struct qstr name = { .name = "" };
+        if (unlikely(fd < 0))
+                return fd;
 
-        dentry = d_alloc(sock_mnt->mnt_sb->s_root, &name);
-        if (unlikely(!dentry))
+        path.dentry = d_alloc(sock_mnt->mnt_sb->s_root, &name);
+        if (unlikely(!path.dentry)) {
+                put_unused_fd(fd);
                 return -ENOMEM;
+        }
+        path.mnt = mntget(sock_mnt);
 
-        dentry->d_op = &sockfs_dentry_operations;
-        /*
-         * We dont want to push this dentry into global dentry hash table.
-         * We pretend dentry is already hashed, by unsetting DCACHE_UNHASHED
-         * This permits a working /proc/$pid/fd/XXX on sockets
-         */
-        dentry->d_flags &= ~DCACHE_UNHASHED;
-        d_instantiate(dentry, SOCK_INODE(sock));
+        path.dentry->d_op = &sockfs_dentry_operations;
+        d_instantiate(path.dentry, SOCK_INODE(sock));
+        SOCK_INODE(sock)->i_fop = &socket_file_ops;
 
-        sock->file = file;
-        init_file(file, sock_mnt, dentry, FMODE_READ | FMODE_WRITE,
+        file = alloc_file(&path, FMODE_READ | FMODE_WRITE,
                   &socket_file_ops);
-        SOCK_INODE(sock)->i_fop = &socket_file_ops;
+        if (unlikely(!file)) {
+                /* drop dentry, keep inode */
+                atomic_inc(&path.dentry->d_inode->i_count);
+                path_put(&path);
+                put_unused_fd(fd);
+                return -ENFILE;
+        }
+
+        sock->file = file;
         file->f_flags = O_RDWR | (flags & O_NONBLOCK);
         file->f_pos = 0;
         file->private_data = sock;
 
-        return 0;
+        *f = file;
+        return fd;
 }
 
 int sock_map_fd(struct socket *sock, int flags)
 {
         struct file *newfile;
-        int fd = sock_alloc_fd(&newfile, flags);
+        int fd = sock_alloc_file(sock, &newfile, flags);
 
-        if (likely(fd >= 0)) {
-                int err = sock_attach_fd(sock, newfile, flags);
-
-                if (unlikely(err < 0)) {
-                        put_filp(newfile);
-                        put_unused_fd(fd);
-                        return err;
-                }
+        if (likely(fd >= 0))
                 fd_install(fd, newfile);
-        }
+
         return fd;
 }
 
@@ -1390,29 +1364,19 @@ SYSCALL_DEFINE4(socketpair, int, family, int, type, int, protocol,
         if (err < 0)
                 goto out_release_both;
 
-        fd1 = sock_alloc_fd(&newfile1, flags & O_CLOEXEC);
+        fd1 = sock_alloc_file(sock1, &newfile1, flags);
         if (unlikely(fd1 < 0)) {
                 err = fd1;
                 goto out_release_both;
         }
 
-        fd2 = sock_alloc_fd(&newfile2, flags & O_CLOEXEC);
+        fd2 = sock_alloc_file(sock2, &newfile2, flags);
         if (unlikely(fd2 < 0)) {
                 err = fd2;
-                put_filp(newfile1);
-                put_unused_fd(fd1);
-                goto out_release_both;
-        }
-
-        err = sock_attach_fd(sock1, newfile1, flags & O_NONBLOCK);
-        if (unlikely(err < 0)) {
-                goto out_fd2;
-        }
-
-        err = sock_attach_fd(sock2, newfile2, flags & O_NONBLOCK);
-        if (unlikely(err < 0)) {
                 fput(newfile1);
-                goto out_fd1;
+                put_unused_fd(fd1);
+                sock_release(sock2);
+                goto out;
         }
 
         audit_fd_pair(fd1, fd2);
@@ -1438,16 +1402,6 @@ out_release_1:
         sock_release(sock1);
 out:
         return err;
-
-out_fd2:
-        put_filp(newfile1);
-        sock_release(sock1);
-out_fd1:
-        put_filp(newfile2);
-        sock_release(sock2);
-        put_unused_fd(fd1);
-        put_unused_fd(fd2);
-        goto out;
 }
 
 /*
@@ -1551,17 +1505,13 @@ SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
          */
         __module_get(newsock->ops->owner);
 
-        newfd = sock_alloc_fd(&newfile, flags & O_CLOEXEC);
+        newfd = sock_alloc_file(newsock, &newfile, flags);
         if (unlikely(newfd < 0)) {
                 err = newfd;
                 sock_release(newsock);
                 goto out_put;
         }
 
-        err = sock_attach_fd(newsock, newfile, flags & O_NONBLOCK);
-        if (err < 0)
-                goto out_fd_simple;
-
         err = security_socket_accept(sock, newsock);
         if (err)
                 goto out_fd;
@@ -1591,11 +1541,6 @@ out_put:
         fput_light(sock->file, fput_needed);
 out:
         return err;
-out_fd_simple:
-        sock_release(newsock);
-        put_filp(newfile);
-        put_unused_fd(newfd);
-        goto out_put;
 out_fd:
         fput(newfile);
         put_unused_fd(newfd);
diff --git a/net/sunrpc/addr.c b/net/sunrpc/addr.c
index c7450c8f0a7c..6dcdd2517819 100644
--- a/net/sunrpc/addr.c
+++ b/net/sunrpc/addr.c
@@ -55,16 +55,8 @@ static size_t rpc_ntop6_noscopeid(const struct sockaddr *sap,
 
         /*
          * RFC 4291, Section 2.2.1
-         *
-         * To keep the result as short as possible, especially
-         * since we don't shorthand, we don't want leading zeros
-         * in each halfword, so avoid %pI6.
          */
-        return snprintf(buf, buflen, "%x:%x:%x:%x:%x:%x:%x:%x",
-                ntohs(addr->s6_addr16[0]), ntohs(addr->s6_addr16[1]),
-                ntohs(addr->s6_addr16[2]), ntohs(addr->s6_addr16[3]),
-                ntohs(addr->s6_addr16[4]), ntohs(addr->s6_addr16[5]),
-                ntohs(addr->s6_addr16[6]), ntohs(addr->s6_addr16[7]));
+        return snprintf(buf, buflen, "%pI6c", addr);
 }
 
 static size_t rpc_ntop6(const struct sockaddr *sap,
diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c
index 7535a7bed2fa..f394fc190a49 100644
--- a/net/sunrpc/auth.c
+++ b/net/sunrpc/auth.c
@@ -123,16 +123,19 @@ rpcauth_unhash_cred_locked(struct rpc_cred *cred)
         clear_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags);
 }
 
-static void
+static int
 rpcauth_unhash_cred(struct rpc_cred *cred)
 {
         spinlock_t *cache_lock;
+        int ret;
 
         cache_lock = &cred->cr_auth->au_credcache->lock;
         spin_lock(cache_lock);
-        if (atomic_read(&cred->cr_count) == 0)
+        ret = atomic_read(&cred->cr_count) == 0;
+        if (ret)
                 rpcauth_unhash_cred_locked(cred);
         spin_unlock(cache_lock);
+        return ret;
 }
 
 /*
@@ -446,31 +449,35 @@ void
 put_rpccred(struct rpc_cred *cred)
 {
         /* Fast path for unhashed credentials */
-        if (test_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags) != 0)
-                goto need_lock;
-
-        if (!atomic_dec_and_test(&cred->cr_count))
+        if (test_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags) == 0) {
+                if (atomic_dec_and_test(&cred->cr_count))
+                        cred->cr_ops->crdestroy(cred);
                 return;
-        goto out_destroy;
-need_lock:
+        }
+
         if (!atomic_dec_and_lock(&cred->cr_count, &rpc_credcache_lock))
                 return;
         if (!list_empty(&cred->cr_lru)) {
                 number_cred_unused--;
                 list_del_init(&cred->cr_lru);
         }
-        if (test_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags) == 0)
-                rpcauth_unhash_cred(cred);
         if (test_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags) != 0) {
-                cred->cr_expire = jiffies;
-                list_add_tail(&cred->cr_lru, &cred_unused);
-                number_cred_unused++;
-                spin_unlock(&rpc_credcache_lock);
-                return;
+                if (test_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags) != 0) {
+                        cred->cr_expire = jiffies;
+                        list_add_tail(&cred->cr_lru, &cred_unused);
+                        number_cred_unused++;
+                        goto out_nodestroy;
+                }
+                if (!rpcauth_unhash_cred(cred)) {
+                        /* We were hashed and someone looked us up... */
+                        goto out_nodestroy;
+                }
         }
         spin_unlock(&rpc_credcache_lock);
-out_destroy:
         cred->cr_ops->crdestroy(cred);
+        return;
+out_nodestroy:
+        spin_unlock(&rpc_credcache_lock);
 }
 EXPORT_SYMBOL_GPL(put_rpccred);
 
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index fc6a43ccd950..3c3c50f38a1c 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -304,7 +304,7 @@ __gss_find_upcall(struct rpc_inode *rpci, uid_t uid)
  * to that upcall instead of adding the new upcall.
  */
 static inline struct gss_upcall_msg *
-gss_add_msg(struct gss_auth *gss_auth, struct gss_upcall_msg *gss_msg)
+gss_add_msg(struct gss_upcall_msg *gss_msg)
 {
         struct rpc_inode *rpci = gss_msg->inode;
         struct inode *inode = &rpci->vfs_inode;
@@ -445,7 +445,7 @@ gss_setup_upcall(struct rpc_clnt *clnt, struct gss_auth *gss_auth, struct rpc_cr
         gss_new = gss_alloc_msg(gss_auth, uid, clnt, gss_cred->gc_machine_cred);
         if (IS_ERR(gss_new))
                 return gss_new;
-        gss_msg = gss_add_msg(gss_auth, gss_new);
+        gss_msg = gss_add_msg(gss_new);
         if (gss_msg == gss_new) {
                 struct inode *inode = &gss_new->inode->vfs_inode;
                 int res = rpc_queue_upcall(inode, &gss_new->msg);
@@ -485,7 +485,7 @@ gss_refresh_upcall(struct rpc_task *task)
         dprintk("RPC: %5u gss_refresh_upcall for uid %u\n", task->tk_pid,
                                                                 cred->cr_uid);
         gss_msg = gss_setup_upcall(task->tk_client, gss_auth, cred);
-        if (IS_ERR(gss_msg) == -EAGAIN) {
+        if (PTR_ERR(gss_msg) == -EAGAIN) {
                 /* XXX: warning on the first, under the assumption we
                  * shouldn't normally hit this case on a refresh. */
                 warn_gssd();
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 38829e20500b..154034b675bd 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -79,7 +79,7 @@ static void	call_connect_status(struct rpc_task *task);
 
 static __be32   *rpc_encode_header(struct rpc_task *task);
 static __be32   *rpc_verify_header(struct rpc_task *task);
-static int      rpc_ping(struct rpc_clnt *clnt, int flags);
+static int      rpc_ping(struct rpc_clnt *clnt);
 
 static void rpc_register_client(struct rpc_clnt *clnt)
 {
@@ -340,7 +340,7 @@ struct rpc_clnt *rpc_create(struct rpc_create_args *args)
                 return clnt;
 
         if (!(args->flags & RPC_CLNT_CREATE_NOPING)) {
-                int err = rpc_ping(clnt, RPC_TASK_SOFT);
+                int err = rpc_ping(clnt);
                 if (err != 0) {
                         rpc_shutdown_client(clnt);
                         return ERR_PTR(err);
@@ -528,7 +528,7 @@ struct rpc_clnt *rpc_bind_new_program(struct rpc_clnt *old,
         clnt->cl_prog     = program->number;
         clnt->cl_vers     = version->number;
         clnt->cl_stats    = program->stats;
-        err = rpc_ping(clnt, RPC_TASK_SOFT);
+        err = rpc_ping(clnt);
         if (err != 0) {
                 rpc_shutdown_client(clnt);
                 clnt = ERR_PTR(err);
@@ -1060,7 +1060,7 @@ call_bind_status(struct rpc_task *task)
                 goto retry_timeout;
         case -EPFNOSUPPORT:
                 /* server doesn't support any rpcbind version we know of */
-                dprintk("RPC: %5u remote rpcbind service unavailable\n",
+                dprintk("RPC: %5u unrecognized remote rpcbind service\n",
                                 task->tk_pid);
                 break;
         case -EPROTONOSUPPORT:
@@ -1069,6 +1069,21 @@ call_bind_status(struct rpc_task *task)
                 task->tk_status = 0;
                 task->tk_action = call_bind;
                 return;
+        case -ECONNREFUSED:             /* connection problems */
+        case -ECONNRESET:
+        case -ENOTCONN:
+        case -EHOSTDOWN:
+        case -EHOSTUNREACH:
+        case -ENETUNREACH:
+        case -EPIPE:
+                dprintk("RPC: %5u remote rpcbind unreachable: %d\n",
+                                task->tk_pid, task->tk_status);
+                if (!RPC_IS_SOFTCONN(task)) {
+                        rpc_delay(task, 5*HZ);
+                        goto retry_timeout;
+                }
+                status = task->tk_status;
+                break;
         default:
                 dprintk("RPC: %5u unrecognized rpcbind error (%d)\n",
                                 task->tk_pid, -task->tk_status);
@@ -1180,11 +1195,25 @@ static void
 call_transmit_status(struct rpc_task *task)
 {
         task->tk_action = call_status;
+
+        /*
+         * Common case: success.  Force the compiler to put this
+         * test first.
+         */
+        if (task->tk_status == 0) {
+                xprt_end_transmit(task);
+                rpc_task_force_reencode(task);
+                return;
+        }
+
         switch (task->tk_status) {
         case -EAGAIN:
                 break;
         default:
+                dprint_status(task);
                 xprt_end_transmit(task);
+                rpc_task_force_reencode(task);
+                break;
                 /*
                  * Special cases: if we've been waiting on the
                  * socket's write_space() callback, or if the
@@ -1192,11 +1221,16 @@ call_transmit_status(struct rpc_task *task)
                  * then hold onto the transport lock.
                  */
         case -ECONNREFUSED:
-        case -ECONNRESET:
-        case -ENOTCONN:
         case -EHOSTDOWN:
         case -EHOSTUNREACH:
         case -ENETUNREACH:
+                if (RPC_IS_SOFTCONN(task)) {
+                        xprt_end_transmit(task);
+                        rpc_exit(task, task->tk_status);
+                        break;
+                }
+        case -ECONNRESET:
+        case -ENOTCONN:
         case -EPIPE:
                 rpc_task_force_reencode(task);
         }
@@ -1346,6 +1380,10 @@ call_timeout(struct rpc_task *task)
         dprintk("RPC: %5u call_timeout (major)\n", task->tk_pid);
         task->tk_timeouts++;
 
+        if (RPC_IS_SOFTCONN(task)) {
+                rpc_exit(task, -ETIMEDOUT);
+                return;
+        }
         if (RPC_IS_SOFT(task)) {
                 if (clnt->cl_chatty)
                         printk(KERN_NOTICE "%s: server %s not responding, timed out\n",
@@ -1675,14 +1713,14 @@ static struct rpc_procinfo rpcproc_null = {
         .p_decode = rpcproc_decode_null,
 };
 
-static int rpc_ping(struct rpc_clnt *clnt, int flags)
+static int rpc_ping(struct rpc_clnt *clnt)
 {
         struct rpc_message msg = {
                 .rpc_proc = &rpcproc_null,
         };
         int err;
         msg.rpc_cred = authnull_ops.lookup_cred(NULL, NULL, 0);
-        err = rpc_call_sync(clnt, &msg, flags);
+        err = rpc_call_sync(clnt, &msg, RPC_TASK_SOFT | RPC_TASK_SOFTCONN);
         put_rpccred(msg.rpc_cred);
         return err;
 }
diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c
index 830faf4d9997..3e3772d8eb92 100644
--- a/net/sunrpc/rpcb_clnt.c
+++ b/net/sunrpc/rpcb_clnt.c
@@ -20,6 +20,7 @@
 #include <linux/in6.h>
 #include <linux/kernel.h>
 #include <linux/errno.h>
+#include <linux/mutex.h>
 #include <net/ipv6.h>
 
 #include <linux/sunrpc/clnt.h>
@@ -110,6 +111,9 @@ static void			rpcb_getport_done(struct rpc_task *, void *);
 static void                     rpcb_map_release(void *data);
 static struct rpc_program       rpcb_program;
 
+static struct rpc_clnt *        rpcb_local_clnt;
+static struct rpc_clnt *        rpcb_local_clnt4;
+
 struct rpcbind_args {
         struct rpc_xprt *       r_xprt;
 
@@ -163,21 +167,60 @@ static const struct sockaddr_in rpcb_inaddr_loopback = {
         .sin_port               = htons(RPCBIND_PORT),
 };
 
-static struct rpc_clnt *rpcb_create_local(struct sockaddr *addr,
-                                          size_t addrlen, u32 version)
+static DEFINE_MUTEX(rpcb_create_local_mutex);
+
+/*
+ * Returns zero on success, otherwise a negative errno value
+ * is returned.
+ */
+static int rpcb_create_local(void)
 {
         struct rpc_create_args args = {
-                .protocol       = XPRT_TRANSPORT_UDP,
-                .address        = addr,
-                .addrsize       = addrlen,
+                .protocol       = XPRT_TRANSPORT_TCP,
+                .address        = (struct sockaddr *)&rpcb_inaddr_loopback,
+                .addrsize       = sizeof(rpcb_inaddr_loopback),
                 .servername     = "localhost",
                 .program        = &rpcb_program,
-                .version        = version,
+                .version        = RPCBVERS_2,
                 .authflavor     = RPC_AUTH_UNIX,
                 .flags          = RPC_CLNT_CREATE_NOPING,
         };
+        struct rpc_clnt *clnt, *clnt4;
+        int result = 0;
+
+        if (rpcb_local_clnt)
+                return result;
+
+        mutex_lock(&rpcb_create_local_mutex);
+        if (rpcb_local_clnt)
+                goto out;
+
+        clnt = rpc_create(&args);
+        if (IS_ERR(clnt)) {
+                dprintk("RPC:       failed to create local rpcbind "
+                                "client (errno %ld).\n", PTR_ERR(clnt));
+                result = -PTR_ERR(clnt);
+                goto out;
+        }
 
-        return rpc_create(&args);
+        /*
+         * This results in an RPC ping.  On systems running portmapper,
+         * the v4 ping will fail.  Proceed anyway, but disallow rpcb
+         * v4 upcalls.
+         */
+        clnt4 = rpc_bind_new_program(clnt, &rpcb_program, RPCBVERS_4);
+        if (IS_ERR(clnt4)) {
+                dprintk("RPC:       failed to create local rpcbind v4 "
+                                "cleint (errno %ld).\n", PTR_ERR(clnt4));
+                clnt4 = NULL;
+        }
+
+        rpcb_local_clnt = clnt;
+        rpcb_local_clnt4 = clnt4;
+
+out:
+        mutex_unlock(&rpcb_create_local_mutex);
+        return result;
 }
 
 static struct rpc_clnt *rpcb_create(char *hostname, struct sockaddr *srvaddr,
@@ -209,22 +252,13 @@ static struct rpc_clnt *rpcb_create(char *hostname, struct sockaddr *srvaddr,
         return rpc_create(&args);
 }
 
-static int rpcb_register_call(const u32 version, struct rpc_message *msg)
+static int rpcb_register_call(struct rpc_clnt *clnt, struct rpc_message *msg)
 {
-        struct sockaddr *addr = (struct sockaddr *)&rpcb_inaddr_loopback;
-        size_t addrlen = sizeof(rpcb_inaddr_loopback);
-        struct rpc_clnt *rpcb_clnt;
         int result, error = 0;
 
         msg->rpc_resp = &result;
 
-        rpcb_clnt = rpcb_create_local(addr, addrlen, version);
-        if (!IS_ERR(rpcb_clnt)) {
-                error = rpc_call_sync(rpcb_clnt, msg, 0);
-                rpc_shutdown_client(rpcb_clnt);
-        } else
-                error = PTR_ERR(rpcb_clnt);
-
+        error = rpc_call_sync(clnt, msg, RPC_TASK_SOFTCONN);
         if (error < 0) {
                 dprintk("RPC:       failed to contact local rpcbind "
                                 "server (errno %d).\n", -error);
@@ -279,6 +313,11 @@ int rpcb_register(u32 prog, u32 vers, int prot, unsigned short port)
         struct rpc_message msg = {
                 .rpc_argp       = &map,
         };
+        int error;
+
+        error = rpcb_create_local();
+        if (error)
+                return error;
 
         dprintk("RPC:       %sregistering (%u, %u, %d, %u) with local "
                         "rpcbind\n", (port ? "" : "un"),
@@ -288,7 +327,7 @@ int rpcb_register(u32 prog, u32 vers, int prot, unsigned short port)
         if (port)
                 msg.rpc_proc = &rpcb_procedures2[RPCBPROC_SET];
 
-        return rpcb_register_call(RPCBVERS_2, &msg);
+        return rpcb_register_call(rpcb_local_clnt, &msg);
 }
 
 /*
@@ -313,7 +352,7 @@ static int rpcb_register_inet4(const struct sockaddr *sap,
         if (port)
                 msg->rpc_proc = &rpcb_procedures4[RPCBPROC_SET];
 
-        result = rpcb_register_call(RPCBVERS_4, msg);
+        result = rpcb_register_call(rpcb_local_clnt4, msg);
         kfree(map->r_addr);
         return result;
 }
@@ -340,7 +379,7 @@ static int rpcb_register_inet6(const struct sockaddr *sap,
         if (port)
                 msg->rpc_proc = &rpcb_procedures4[RPCBPROC_SET];
 
-        result = rpcb_register_call(RPCBVERS_4, msg);
+        result = rpcb_register_call(rpcb_local_clnt4, msg);
         kfree(map->r_addr);
         return result;
 }
@@ -356,7 +395,7 @@ static int rpcb_unregister_all_protofamilies(struct rpc_message *msg)
         map->r_addr = "";
         msg->rpc_proc = &rpcb_procedures4[RPCBPROC_UNSET];
 
-        return rpcb_register_call(RPCBVERS_4, msg);
+        return rpcb_register_call(rpcb_local_clnt4, msg);
 }
 
 /**
@@ -414,6 +453,13 @@ int rpcb_v4_register(const u32 program, const u32 version,
         struct rpc_message msg = {
                 .rpc_argp       = &map,
         };
+        int error;
+
+        error = rpcb_create_local();
+        if (error)
+                return error;
+        if (rpcb_local_clnt4 == NULL)
+                return -EPROTONOSUPPORT;
 
         if (address == NULL)
                 return rpcb_unregister_all_protofamilies(&msg);
@@ -491,7 +537,7 @@ static struct rpc_task *rpcb_call_async(struct rpc_clnt *rpcb_clnt, struct rpcbi
                 .rpc_message = &msg,
                 .callback_ops = &rpcb_getport_ops,
                 .callback_data = map,
-                .flags = RPC_TASK_ASYNC,
+                .flags = RPC_TASK_ASYNC | RPC_TASK_SOFTCONN,
         };
 
         return rpc_run_task(&task_setup_data);
@@ -1027,3 +1073,15 @@ static struct rpc_program rpcb_program = {
         .version        = rpcb_version,
         .stats          = &rpcb_stats,
 };
+
+/**
+ * cleanup_rpcb_clnt - remove xprtsock's sysctls, unregister
+ *
+ */
+void cleanup_rpcb_clnt(void)
+{
+        if (rpcb_local_clnt4)
+                rpc_shutdown_client(rpcb_local_clnt4);
+        if (rpcb_local_clnt)
+                rpc_shutdown_client(rpcb_local_clnt);
+}
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index cef74ba0666c..aae6907fd546 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -210,6 +210,7 @@ void rpc_init_priority_wait_queue(struct rpc_wait_queue *queue, const char *qnam
 {
         __rpc_init_priority_wait_queue(queue, qname, RPC_NR_PRIORITY);
 }
+EXPORT_SYMBOL_GPL(rpc_init_priority_wait_queue);
 
 void rpc_init_wait_queue(struct rpc_wait_queue *queue, const char *qname)
 {
@@ -385,6 +386,20 @@ static void rpc_wake_up_task_queue_locked(struct rpc_wait_queue *queue, struct r
 }
 
 /*
+ * Tests whether rpc queue is empty
+ */
+int rpc_queue_empty(struct rpc_wait_queue *queue)
+{
+        int res;
+
+        spin_lock_bh(&queue->lock);
+        res = queue->qlen;
+        spin_unlock_bh(&queue->lock);
+        return (res == 0);
+}
+EXPORT_SYMBOL_GPL(rpc_queue_empty);
+
+/*
  * Wake up a task on a specific queue
  */
 void rpc_wake_up_queued_task(struct rpc_wait_queue *queue, struct rpc_task *task)
diff --git a/net/sunrpc/sunrpc_syms.c b/net/sunrpc/sunrpc_syms.c
index 8cce92189019..f438347d817b 100644
--- a/net/sunrpc/sunrpc_syms.c
+++ b/net/sunrpc/sunrpc_syms.c
@@ -24,6 +24,8 @@
 
 extern struct cache_detail ip_map_cache, unix_gid_cache;
 
+extern void cleanup_rpcb_clnt(void);
+
 static int __init
 init_sunrpc(void)
 {
@@ -53,6 +55,7 @@ out:
 static void __exit
 cleanup_sunrpc(void)
 {
+        cleanup_rpcb_clnt();
         rpcauth_remove_module();
         cleanup_socket_xprt();
         svc_cleanup_xprt_sock();
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index b845e2293dfe..7d1f9e928f69 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -16,8 +16,6 @@
 
 #define RPCDBG_FACILITY RPCDBG_SVCXPRT
 
-#define SVC_MAX_WAKING 5
-
 static struct svc_deferred_req *svc_deferred_dequeue(struct svc_xprt *xprt);
 static int svc_deferred_recv(struct svc_rqst *rqstp);
 static struct cache_deferred_req *svc_defer(struct cache_req *req);
@@ -306,7 +304,6 @@ void svc_xprt_enqueue(struct svc_xprt *xprt)
         struct svc_pool *pool;
         struct svc_rqst *rqstp;
         int cpu;
-        int thread_avail;
 
         if (!(xprt->xpt_flags &
               ((1<<XPT_CONN)|(1<<XPT_DATA)|(1<<XPT_CLOSE)|(1<<XPT_DEFERRED))))
@@ -318,6 +315,12 @@ void svc_xprt_enqueue(struct svc_xprt *xprt)
 
         spin_lock_bh(&pool->sp_lock);
 
+        if (!list_empty(&pool->sp_threads) &&
+            !list_empty(&pool->sp_sockets))
+                printk(KERN_ERR
+                       "svc_xprt_enqueue: "
+                       "threads and transports both waiting??\n");
+
         if (test_bit(XPT_DEAD, &xprt->xpt_flags)) {
                 /* Don't enqueue dead transports */
                 dprintk("svc: transport %p is dead, not enqueued\n", xprt);
@@ -358,15 +361,7 @@ void svc_xprt_enqueue(struct svc_xprt *xprt)
         }
 
  process:
-        /* Work out whether threads are available */
-        thread_avail = !list_empty(&pool->sp_threads);  /* threads are asleep */
-        if (pool->sp_nwaking >= SVC_MAX_WAKING) {
-                /* too many threads are runnable and trying to wake up */
-                thread_avail = 0;
-                pool->sp_stats.overloads_avoided++;
-        }
-
-        if (thread_avail) {
+        if (!list_empty(&pool->sp_threads)) {
                 rqstp = list_entry(pool->sp_threads.next,
                                    struct svc_rqst,
                                    rq_list);
@@ -381,8 +376,6 @@ void svc_xprt_enqueue(struct svc_xprt *xprt)
                 svc_xprt_get(xprt);
                 rqstp->rq_reserved = serv->sv_max_mesg;
                 atomic_add(rqstp->rq_reserved, &xprt->xpt_reserved);
-                rqstp->rq_waking = 1;
-                pool->sp_nwaking++;
                 pool->sp_stats.threads_woken++;
                 BUG_ON(xprt->xpt_pool != pool);
                 wake_up(&rqstp->rq_wait);
@@ -651,11 +644,6 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
                 return -EINTR;
 
         spin_lock_bh(&pool->sp_lock);
-        if (rqstp->rq_waking) {
-                rqstp->rq_waking = 0;
-                pool->sp_nwaking--;
-                BUG_ON(pool->sp_nwaking < 0);
-        }
         xprt = svc_xprt_dequeue(pool);
         if (xprt) {
                 rqstp->rq_xprt = xprt;
@@ -711,7 +699,8 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
         spin_unlock_bh(&pool->sp_lock);
 
         len = 0;
-        if (test_bit(XPT_LISTENER, &xprt->xpt_flags)) {
+        if (test_bit(XPT_LISTENER, &xprt->xpt_flags) &&
+            !test_bit(XPT_CLOSE, &xprt->xpt_flags)) {
                 struct svc_xprt *newxpt;
                 newxpt = xprt->xpt_ops->xpo_accept(xprt);
                 if (newxpt) {
@@ -1204,16 +1193,15 @@ static int svc_pool_stats_show(struct seq_file *m, void *p)
         struct svc_pool *pool = p;
 
         if (p == SEQ_START_TOKEN) {
-                seq_puts(m, "# pool packets-arrived sockets-enqueued threads-woken overloads-avoided threads-timedout\n");
+                seq_puts(m, "# pool packets-arrived sockets-enqueued threads-woken threads-timedout\n");
                 return 0;
         }
 
-        seq_printf(m, "%u %lu %lu %lu %lu %lu\n",
+        seq_printf(m, "%u %lu %lu %lu %lu\n",
                 pool->sp_id,
                 pool->sp_stats.packets,
                 pool->sp_stats.sockets_queued,
                 pool->sp_stats.threads_woken,
-                pool->sp_stats.overloads_avoided,
                 pool->sp_stats.threads_timedout);
 
         return 0;
diff --git a/net/sunrpc/svcauth_unix.c b/net/sunrpc/svcauth_unix.c
index 4a8f6558718a..d8c041114497 100644
--- a/net/sunrpc/svcauth_unix.c
+++ b/net/sunrpc/svcauth_unix.c
@@ -655,23 +655,25 @@ static struct unix_gid *unix_gid_lookup(uid_t uid)
                 return NULL;
 }
 
-static int unix_gid_find(uid_t uid, struct group_info **gip,
-                         struct svc_rqst *rqstp)
+static struct group_info *unix_gid_find(uid_t uid, struct svc_rqst *rqstp)
 {
-        struct unix_gid *ug = unix_gid_lookup(uid);
+        struct unix_gid *ug;
+        struct group_info *gi;
+        int ret;
+
+        ug = unix_gid_lookup(uid);
         if (!ug)
-                return -EAGAIN;
-        switch (cache_check(&unix_gid_cache, &ug->h, &rqstp->rq_chandle)) {
+                return ERR_PTR(-EAGAIN);
+        ret = cache_check(&unix_gid_cache, &ug->h, &rqstp->rq_chandle);
+        switch (ret) {
         case -ENOENT:
-                *gip = NULL;
-                return 0;
+                return ERR_PTR(-ENOENT);
         case 0:
-                *gip = ug->gi;
-                get_group_info(*gip);
+                gi = get_group_info(ug->gi);
                 cache_put(&ug->h, &unix_gid_cache);
-                return 0;
+                return gi;
         default:
-                return -EAGAIN;
+                return ERR_PTR(-EAGAIN);
         }
 }
 
@@ -681,6 +683,8 @@ svcauth_unix_set_client(struct svc_rqst *rqstp)
         struct sockaddr_in *sin;
         struct sockaddr_in6 *sin6, sin6_storage;
         struct ip_map *ipm;
+        struct group_info *gi;
+        struct svc_cred *cred = &rqstp->rq_cred;
 
         switch (rqstp->rq_addr.ss_family) {
         case AF_INET:
@@ -721,6 +725,17 @@ svcauth_unix_set_client(struct svc_rqst *rqstp)
                         ip_map_cached_put(rqstp, ipm);
                         break;
         }
+
+        gi = unix_gid_find(cred->cr_uid, rqstp);
+        switch (PTR_ERR(gi)) {
+        case -EAGAIN:
+                return SVC_DROP;
+        case -ENOENT:
+                break;
+        default:
+                put_group_info(cred->cr_group_info);
+                cred->cr_group_info = gi;
+        }
         return SVC_OK;
 }
 
@@ -817,19 +832,11 @@ svcauth_unix_accept(struct svc_rqst *rqstp, __be32 *authp)
         slen = svc_getnl(argv);                 /* gids length */
         if (slen > 16 || (len -= (slen + 2)*4) < 0)
                 goto badcred;
-        if (unix_gid_find(cred->cr_uid, &cred->cr_group_info, rqstp)
-            == -EAGAIN)
+        cred->cr_group_info = groups_alloc(slen);
+        if (cred->cr_group_info == NULL)
                 return SVC_DROP;
-        if (cred->cr_group_info == NULL) {
-                cred->cr_group_info = groups_alloc(slen);
-                if (cred->cr_group_info == NULL)
-                        return SVC_DROP;
-                for (i = 0; i < slen; i++)
-                        GROUP_AT(cred->cr_group_info, i) = svc_getnl(argv);
-        } else {
-                for (i = 0; i < slen ; i++)
-                        svc_getnl(argv);
-        }
+        for (i = 0; i < slen; i++)
+                GROUP_AT(cred->cr_group_info, i) = svc_getnl(argv);
         if (svc_getu32(argv) != htonl(RPC_AUTH_NULL) || svc_getu32(argv) != 0) {
                 *authp = rpc_autherr_badverf;
                 return SVC_DENIED;
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index fd46d42afa89..469de292c23c 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -700,6 +700,10 @@ void xprt_connect(struct rpc_task *task)
         }
         if (!xprt_lock_write(xprt, task))
                 return;
+
+        if (test_and_clear_bit(XPRT_CLOSE_WAIT, &xprt->state))
+                xprt->ops->close(xprt);
+
         if (xprt_connected(xprt))
                 xprt_release_write(xprt, task);
         else {
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 04732d09013e..3d739e5d15d8 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -2019,7 +2019,7 @@ static void xs_connect(struct rpc_task *task)
         if (xprt_test_and_set_connecting(xprt))
                 return;
 
-        if (transport->sock != NULL) {
+        if (transport->sock != NULL && !RPC_IS_SOFTCONN(task)) {
                 dprintk("RPC:       xs_connect delayed xprt %p for %lu "
                                 "seconds\n",
                                 xprt, xprt->reestablish_timeout / HZ);
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 1001db4912f7..82e6002c8d67 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -93,7 +93,18 @@ void cfg80211_send_rx_assoc(struct net_device *dev, const u8 *buf, size_t len)
                         }
                 }
 
-                WARN_ON(!bss);
+                /*
+                 * We might be coming here because the driver reported
+                 * a successful association at the same time as the
+                 * user requested a deauth. In that case, we will have
+                 * removed the BSS from the auth_bsses list due to the
+                 * deauth request when the assoc response makes it. If
+                 * the two code paths acquire the lock the other way
+                 * around, that's just the standard situation of a
+                 * deauth being requested while connected.
+                 */
+                if (!bss)
+                        goto out;
         } else if (wdev->conn) {
                 cfg80211_sme_failed_assoc(wdev);
                 /*
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 12dfa62aad18..0c2cbbebca95 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -601,7 +601,7 @@ int cfg80211_wext_siwscan(struct net_device *dev,
         struct cfg80211_registered_device *rdev;
         struct wiphy *wiphy;
         struct iw_scan_req *wreq = NULL;
-        struct cfg80211_scan_request *creq;
+        struct cfg80211_scan_request *creq = NULL;
         int i, err, n_channels = 0;
         enum ieee80211_band band;
 
@@ -694,8 +694,10 @@ int cfg80211_wext_siwscan(struct net_device *dev,
         /* translate "Scan for SSID" request */
         if (wreq) {
                 if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
-                        if (wreq->essid_len > IEEE80211_MAX_SSID_LEN)
-                                return -EINVAL;
+                        if (wreq->essid_len > IEEE80211_MAX_SSID_LEN) {
+                                err = -EINVAL;
+                                goto out;
+                        }
                         memcpy(creq->ssids[0].ssid, wreq->essid, wreq->essid_len);
                         creq->ssids[0].ssid_len = wreq->essid_len;
                 }
@@ -707,12 +709,15 @@ int cfg80211_wext_siwscan(struct net_device *dev,
         err = rdev->ops->scan(wiphy, dev, creq);
         if (err) {
                 rdev->scan_req = NULL;
-                kfree(creq);
+                /* creq will be freed below */
         } else {
                 nl80211_send_scan_start(rdev, dev);
+                /* creq now owned by driver */
+                creq = NULL;
                 dev_hold(dev);
         }
  out:
+        kfree(creq);
         cfg80211_unlock_rdev(rdev);
         return err;
 }
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index cb81ca35b0d6..4725a549ad4d 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1445,7 +1445,7 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,
         if (!dev)
                 goto free_dst;
 
-        /* Copy neighbout for reachability confirmation */
+        /* Copy neighbour for reachability confirmation */
         dst0->neighbour = neigh_clone(dst->neighbour);
 
         xfrm_init_path((struct xfrm_dst *)dst0, dst, nfheader_len);