Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (94 commits)
  pkt_sched: Prevent livelock in TX queue running.
  Revert "pkt_sched: Add BH protection for qdisc_stab_lock."
  Revert "pkt_sched: Protect gen estimators under est_lock."
  pkt_sched: remove bogus block (cleanup)
  nf_nat: use secure_ipv4_port_ephemeral() for NAT port randomization
  netfilter: ctnetlink: sleepable allocation with spin lock bh
  netfilter: ctnetlink: fix sleep in read-side lock section
  netfilter: ctnetlink: fix double helper assignation for NAT'ed conntracks
  netfilter: ipt_addrtype: Fix matching of inverted destination address type
  dccp: Fix panic caused by too early termination of retransmission mechanism
  pkt_sched: Don't hold qdisc lock over qdisc_destroy().
  pkt_sched: Add lockdep annotation for qdisc locks
  pkt_sched: Never schedule non-root qdiscs.
  removed unused #include <version.h>
  rt2x00: Fix txdone_entry_desc_flags
  b43: Fix for another Bluetooth Coexistence SPROM Programming error for BCM4306
  mac80211: remove kdoc references to IEEE80211_HW_HOST_GEN_BEACON_TEMPLATE
  p54u: reset skb's data/tail pointer on requeue
  p54: move p54_vdcf_init to the right place.
  iwlwifi: fix printk newlines
  ...

34 files changed, 511 insertions, 369 deletions

diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 4e59df5f8e05..1edfdf4c095b 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -456,7 +456,7 @@ static void __exit bt_exit(void)
 subsys_initcall(bt_init);
 module_exit(bt_exit);
 
-MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>, Marcel Holtmann <marcel@holtmann.org>");
+MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
 MODULE_DESCRIPTION("Bluetooth Core ver " VERSION);
 MODULE_VERSION(VERSION);
 MODULE_LICENSE("GPL");
diff --git a/net/bluetooth/bnep/core.c b/net/bluetooth/bnep/core.c
index 12bba6207a8d..80ba30cf4b68 100644
--- a/net/bluetooth/bnep/core.c
+++ b/net/bluetooth/bnep/core.c
@@ -736,7 +736,7 @@ MODULE_PARM_DESC(compress_src, "Compress sources headers");
 module_param(compress_dst, bool, 0644);
 MODULE_PARM_DESC(compress_dst, "Compress destination headers");
 
-MODULE_AUTHOR("David Libault <david.libault@inventel.fr>, Maxim Krasnyansky <maxk@qualcomm.com>");
+MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
 MODULE_DESCRIPTION("Bluetooth BNEP ver " VERSION);
 MODULE_VERSION(VERSION);
 MODULE_LICENSE("GPL");
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index c85bf8f678dc..f4f6615cad9f 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -3,8 +3,6 @@
 #include <linux/kernel.h>
 #include <linux/init.h>
 
-#include <linux/platform_device.h>
-
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
 
@@ -12,10 +10,164 @@
 #undef  BT_DBG
 #define BT_DBG(D...)
 #endif
+
+struct class *bt_class = NULL;
+EXPORT_SYMBOL_GPL(bt_class);
+
 static struct workqueue_struct *btaddconn;
 static struct workqueue_struct *btdelconn;
 
-static inline char *typetostr(int type)
+static inline char *link_typetostr(int type)
+{
+        switch (type) {
+        case ACL_LINK:
+                return "ACL";
+        case SCO_LINK:
+                return "SCO";
+        case ESCO_LINK:
+                return "eSCO";
+        default:
+                return "UNKNOWN";
+        }
+}
+
+static ssize_t show_link_type(struct device *dev, struct device_attribute *attr, char *buf)
+{
+        struct hci_conn *conn = dev_get_drvdata(dev);
+        return sprintf(buf, "%s\n", link_typetostr(conn->type));
+}
+
+static ssize_t show_link_address(struct device *dev, struct device_attribute *attr, char *buf)
+{
+        struct hci_conn *conn = dev_get_drvdata(dev);
+        bdaddr_t bdaddr;
+        baswap(&bdaddr, &conn->dst);
+        return sprintf(buf, "%s\n", batostr(&bdaddr));
+}
+
+static ssize_t show_link_features(struct device *dev, struct device_attribute *attr, char *buf)
+{
+        struct hci_conn *conn = dev_get_drvdata(dev);
+
+        return sprintf(buf, "0x%02x%02x%02x%02x%02x%02x%02x%02x\n",
+                                conn->features[0], conn->features[1],
+                                conn->features[2], conn->features[3],
+                                conn->features[4], conn->features[5],
+                                conn->features[6], conn->features[7]);
+}
+
+#define LINK_ATTR(_name,_mode,_show,_store) \
+struct device_attribute link_attr_##_name = __ATTR(_name,_mode,_show,_store)
+
+static LINK_ATTR(type, S_IRUGO, show_link_type, NULL);
+static LINK_ATTR(address, S_IRUGO, show_link_address, NULL);
+static LINK_ATTR(features, S_IRUGO, show_link_features, NULL);
+
+static struct attribute *bt_link_attrs[] = {
+        &link_attr_type.attr,
+        &link_attr_address.attr,
+        &link_attr_features.attr,
+        NULL
+};
+
+static struct attribute_group bt_link_group = {
+        .attrs = bt_link_attrs,
+};
+
+static struct attribute_group *bt_link_groups[] = {
+        &bt_link_group,
+        NULL
+};
+
+static void bt_link_release(struct device *dev)
+{
+        void *data = dev_get_drvdata(dev);
+        kfree(data);
+}
+
+static struct device_type bt_link = {
+        .name    = "link",
+        .groups  = bt_link_groups,
+        .release = bt_link_release,
+};
+
+static void add_conn(struct work_struct *work)
+{
+        struct hci_conn *conn = container_of(work, struct hci_conn, work);
+
+        flush_workqueue(btdelconn);
+
+        if (device_add(&conn->dev) < 0) {
+                BT_ERR("Failed to register connection device");
+                return;
+        }
+}
+
+void hci_conn_add_sysfs(struct hci_conn *conn)
+{
+        struct hci_dev *hdev = conn->hdev;
+
+        BT_DBG("conn %p", conn);
+
+        conn->dev.type = &bt_link;
+        conn->dev.class = bt_class;
+        conn->dev.parent = &hdev->dev;
+
+        snprintf(conn->dev.bus_id, BUS_ID_SIZE, "%s:%d",
+                                        hdev->name, conn->handle);
+
+        dev_set_drvdata(&conn->dev, conn);
+
+        device_initialize(&conn->dev);
+
+        INIT_WORK(&conn->work, add_conn);
+
+        queue_work(btaddconn, &conn->work);
+}
+
+/*
+ * The rfcomm tty device will possibly retain even when conn
+ * is down, and sysfs doesn't support move zombie device,
+ * so we should move the device before conn device is destroyed.
+ */
+static int __match_tty(struct device *dev, void *data)
+{
+        return !strncmp(dev->bus_id, "rfcomm", 6);
+}
+
+static void del_conn(struct work_struct *work)
+{
+        struct hci_conn *conn = container_of(work, struct hci_conn, work);
+        struct hci_dev *hdev = conn->hdev;
+
+        while (1) {
+                struct device *dev;
+
+                dev = device_find_child(&conn->dev, NULL, __match_tty);
+                if (!dev)
+                        break;
+                device_move(dev, NULL);
+                put_device(dev);
+        }
+
+        device_del(&conn->dev);
+        put_device(&conn->dev);
+        hci_dev_put(hdev);
+}
+
+void hci_conn_del_sysfs(struct hci_conn *conn)
+{
+        BT_DBG("conn %p", conn);
+
+        if (!device_is_registered(&conn->dev))
+                return;
+
+        INIT_WORK(&conn->work, del_conn);
+
+        queue_work(btdelconn, &conn->work);
+}
+
+static inline char *host_typetostr(int type)
 {
         switch (type) {
         case HCI_VIRTUAL:
@@ -40,7 +192,7 @@ static inline char *typetostr(int type)
 static ssize_t show_type(struct device *dev, struct device_attribute *attr, char *buf)
 {
         struct hci_dev *hdev = dev_get_drvdata(dev);
-        return sprintf(buf, "%s\n", typetostr(hdev->type));
+        return sprintf(buf, "%s\n", host_typetostr(hdev->type));
 }
 
 static ssize_t show_name(struct device *dev, struct device_attribute *attr, char *buf)
@@ -221,183 +373,62 @@ static DEVICE_ATTR(sniff_max_interval, S_IRUGO | S_IWUSR,
 static DEVICE_ATTR(sniff_min_interval, S_IRUGO | S_IWUSR,
                                 show_sniff_min_interval, store_sniff_min_interval);
 
-static struct device_attribute *bt_attrs[] = {
-        &dev_attr_type,
-        &dev_attr_name,
-        &dev_attr_class,
-        &dev_attr_address,
-        &dev_attr_features,
-        &dev_attr_manufacturer,
-        &dev_attr_hci_version,
-        &dev_attr_hci_revision,
-        &dev_attr_inquiry_cache,
-        &dev_attr_idle_timeout,
-        &dev_attr_sniff_max_interval,
-        &dev_attr_sniff_min_interval,
+static struct attribute *bt_host_attrs[] = {
+        &dev_attr_type.attr,
+        &dev_attr_name.attr,
+        &dev_attr_class.attr,
+        &dev_attr_address.attr,
+        &dev_attr_features.attr,
+        &dev_attr_manufacturer.attr,
+        &dev_attr_hci_version.attr,
+        &dev_attr_hci_revision.attr,
+        &dev_attr_inquiry_cache.attr,
+        &dev_attr_idle_timeout.attr,
+        &dev_attr_sniff_max_interval.attr,
+        &dev_attr_sniff_min_interval.attr,
         NULL
 };
 
-static ssize_t show_conn_type(struct device *dev, struct device_attribute *attr, char *buf)
-{
-        struct hci_conn *conn = dev_get_drvdata(dev);
-        return sprintf(buf, "%s\n", conn->type == ACL_LINK ? "ACL" : "SCO");
-}
-
-static ssize_t show_conn_address(struct device *dev, struct device_attribute *attr, char *buf)
-{
-        struct hci_conn *conn = dev_get_drvdata(dev);
-        bdaddr_t bdaddr;
-        baswap(&bdaddr, &conn->dst);
-        return sprintf(buf, "%s\n", batostr(&bdaddr));
-}
-
-static ssize_t show_conn_features(struct device *dev, struct device_attribute *attr, char *buf)
-{
-        struct hci_conn *conn = dev_get_drvdata(dev);
-
-        return sprintf(buf, "0x%02x%02x%02x%02x%02x%02x%02x%02x\n",
-                                conn->features[0], conn->features[1],
-                                conn->features[2], conn->features[3],
-                                conn->features[4], conn->features[5],
-                                conn->features[6], conn->features[7]);
-}
-
-#define CONN_ATTR(_name,_mode,_show,_store) \
-struct device_attribute conn_attr_##_name = __ATTR(_name,_mode,_show,_store)
-
-static CONN_ATTR(type, S_IRUGO, show_conn_type, NULL);
-static CONN_ATTR(address, S_IRUGO, show_conn_address, NULL);
-static CONN_ATTR(features, S_IRUGO, show_conn_features, NULL);
-
-static struct device_attribute *conn_attrs[] = {
-        &conn_attr_type,
-        &conn_attr_address,
-        &conn_attr_features,
-        NULL
+static struct attribute_group bt_host_group = {
+        .attrs = bt_host_attrs,
 };
 
-struct class *bt_class = NULL;
-EXPORT_SYMBOL_GPL(bt_class);
-
-static struct bus_type bt_bus = {
-        .name   = "bluetooth",
+static struct attribute_group *bt_host_groups[] = {
+        &bt_host_group,
+        NULL
 };
 
-static struct platform_device *bt_platform;
-
-static void bt_release(struct device *dev)
+static void bt_host_release(struct device *dev)
 {
         void *data = dev_get_drvdata(dev);
         kfree(data);
 }
 
-static void add_conn(struct work_struct *work)
-{
-        struct hci_conn *conn = container_of(work, struct hci_conn, work);
-        int i;
-
-        flush_workqueue(btdelconn);
-
-        if (device_add(&conn->dev) < 0) {
-                BT_ERR("Failed to register connection device");
-                return;
-        }
-
-        for (i = 0; conn_attrs[i]; i++)
-                if (device_create_file(&conn->dev, conn_attrs[i]) < 0)
-                        BT_ERR("Failed to create connection attribute");
-}
-
-void hci_conn_add_sysfs(struct hci_conn *conn)
-{
-        struct hci_dev *hdev = conn->hdev;
-
-        BT_DBG("conn %p", conn);
-
-        conn->dev.bus = &bt_bus;
-        conn->dev.parent = &hdev->dev;
-
-        conn->dev.release = bt_release;
-
-        snprintf(conn->dev.bus_id, BUS_ID_SIZE, "%s:%d",
-                                        hdev->name, conn->handle);
-
-        dev_set_drvdata(&conn->dev, conn);
-
-        device_initialize(&conn->dev);
-
-        INIT_WORK(&conn->work, add_conn);
-
-        queue_work(btaddconn, &conn->work);
-}
-
-/*
- * The rfcomm tty device will possibly retain even when conn
- * is down, and sysfs doesn't support move zombie device,
- * so we should move the device before conn device is destroyed.
- */
-static int __match_tty(struct device *dev, void *data)
-{
-        return !strncmp(dev->bus_id, "rfcomm", 6);
-}
-
-static void del_conn(struct work_struct *work)
-{
-        struct hci_conn *conn = container_of(work, struct hci_conn, work);
-        struct hci_dev *hdev = conn->hdev;
-
-        while (1) {
-                struct device *dev;
-
-                dev = device_find_child(&conn->dev, NULL, __match_tty);
-                if (!dev)
-                        break;
-                device_move(dev, NULL);
-                put_device(dev);
-        }
-
-        device_del(&conn->dev);
-        put_device(&conn->dev);
-        hci_dev_put(hdev);
-}
-
-void hci_conn_del_sysfs(struct hci_conn *conn)
-{
-        BT_DBG("conn %p", conn);
-
-        if (!device_is_registered(&conn->dev))
-                return;
-
-        INIT_WORK(&conn->work, del_conn);
-
-        queue_work(btdelconn, &conn->work);
-}
+static struct device_type bt_host = {
+        .name    = "host",
+        .groups  = bt_host_groups,
+        .release = bt_host_release,
+};
 
 int hci_register_sysfs(struct hci_dev *hdev)
 {
         struct device *dev = &hdev->dev;
-        unsigned int i;
         int err;
 
         BT_DBG("%p name %s type %d", hdev, hdev->name, hdev->type);
 
-        dev->bus = &bt_bus;
+        dev->type = &bt_host;
+        dev->class = bt_class;
         dev->parent = hdev->parent;
 
         strlcpy(dev->bus_id, hdev->name, BUS_ID_SIZE);
 
-        dev->release = bt_release;
-
         dev_set_drvdata(dev, hdev);
 
         err = device_register(dev);
         if (err < 0)
                 return err;
 
-        for (i = 0; bt_attrs[i]; i++)
-                if (device_create_file(dev, bt_attrs[i]) < 0)
-                        BT_ERR("Failed to create device attribute");
-
         return 0;
 }
 
@@ -410,59 +441,30 @@ void hci_unregister_sysfs(struct hci_dev *hdev)
 
 int __init bt_sysfs_init(void)
 {
-        int err;
-
         btaddconn = create_singlethread_workqueue("btaddconn");
-        if (!btaddconn) {
-                err = -ENOMEM;
-                goto out;
-        }
+        if (!btaddconn)
+                return -ENOMEM;
 
         btdelconn = create_singlethread_workqueue("btdelconn");
         if (!btdelconn) {
-                err = -ENOMEM;
-                goto out_del;
-        }
-
-        bt_platform = platform_device_register_simple("bluetooth", -1, NULL, 0);
-        if (IS_ERR(bt_platform)) {
-                err = PTR_ERR(bt_platform);
-                goto out_platform;
+                destroy_workqueue(btaddconn);
+                return -ENOMEM;
         }
 
-        err = bus_register(&bt_bus);
-        if (err < 0)
-                goto out_bus;
-
         bt_class = class_create(THIS_MODULE, "bluetooth");
         if (IS_ERR(bt_class)) {
-                err = PTR_ERR(bt_class);
-                goto out_class;
+                destroy_workqueue(btdelconn);
+                destroy_workqueue(btaddconn);
+                return PTR_ERR(bt_class);
         }
 
         return 0;
-
-out_class:
-        bus_unregister(&bt_bus);
-out_bus:
-        platform_device_unregister(bt_platform);
-out_platform:
-        destroy_workqueue(btdelconn);
-out_del:
-        destroy_workqueue(btaddconn);
-out:
-        return err;
 }
 
 void bt_sysfs_cleanup(void)
 {
         destroy_workqueue(btaddconn);
-
         destroy_workqueue(btdelconn);
 
         class_destroy(bt_class);
-
-        bus_unregister(&bt_bus);
-
-        platform_device_unregister(bt_platform);
 }
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index c1239852834a..3396d5bdef1c 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -2516,7 +2516,7 @@ EXPORT_SYMBOL(l2cap_load);
 module_init(l2cap_init);
 module_exit(l2cap_exit);
 
-MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>, Marcel Holtmann <marcel@holtmann.org>");
+MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
 MODULE_DESCRIPTION("Bluetooth L2CAP ver " VERSION);
 MODULE_VERSION(VERSION);
 MODULE_LICENSE("GPL");
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 6cfc7ba611b3..ba537fae0a4c 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -2115,7 +2115,7 @@ MODULE_PARM_DESC(channel_mtu, "Default MTU for the RFCOMM channel");
 module_param(l2cap_mtu, uint, 0644);
 MODULE_PARM_DESC(l2cap_mtu, "Default MTU for the L2CAP connection");
 
-MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>, Marcel Holtmann <marcel@holtmann.org>");
+MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
 MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION);
 MODULE_VERSION(VERSION);
 MODULE_LICENSE("GPL");
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 8cda49874868..a16011fedc1d 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -1002,7 +1002,7 @@ module_exit(sco_exit);
 module_param(disable_esco, bool, 0644);
 MODULE_PARM_DESC(disable_esco, "Disable eSCO connection creation");
 
-MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>, Marcel Holtmann <marcel@holtmann.org>");
+MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
 MODULE_DESCRIPTION("Bluetooth SCO ver " VERSION);
 MODULE_VERSION(VERSION);
 MODULE_LICENSE("GPL");
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 9b58d70b0e7d..4f52c3d50ebe 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -148,11 +148,16 @@ static int br_set_tx_csum(struct net_device *dev, u32 data)
 }
 
 static struct ethtool_ops br_ethtool_ops = {
-        .get_drvinfo = br_getinfo,
-        .get_link = ethtool_op_get_link,
-        .set_sg = br_set_sg,
-        .set_tx_csum = br_set_tx_csum,
-        .set_tso = br_set_tso,
+        .get_drvinfo    = br_getinfo,
+        .get_link       = ethtool_op_get_link,
+        .get_tx_csum    = ethtool_op_get_tx_csum,
+        .set_tx_csum    = br_set_tx_csum,
+        .get_sg         = ethtool_op_get_sg,
+        .set_sg         = br_set_sg,
+        .get_tso        = ethtool_op_get_tso,
+        .set_tso        = br_set_tso,
+        .get_ufo        = ethtool_op_get_ufo,
+        .get_flags      = ethtool_op_get_flags,
 };
 
 void br_dev_setup(struct net_device *dev)
diff --git a/net/core/datagram.c b/net/core/datagram.c
index dd61dcad6019..52f577a0f544 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -339,6 +339,93 @@ fault:
         return -EFAULT;
 }
 
+/**
+ *      skb_copy_datagram_from_iovec - Copy a datagram from an iovec.
+ *      @skb: buffer to copy
+ *      @offset: offset in the buffer to start copying to
+ *      @from: io vector to copy to
+ *      @len: amount of data to copy to buffer from iovec
+ *
+ *      Returns 0 or -EFAULT.
+ *      Note: the iovec is modified during the copy.
+ */
+int skb_copy_datagram_from_iovec(struct sk_buff *skb, int offset,
+                                 struct iovec *from, int len)
+{
+        int start = skb_headlen(skb);
+        int i, copy = start - offset;
+
+        /* Copy header. */
+        if (copy > 0) {
+                if (copy > len)
+                        copy = len;
+                if (memcpy_fromiovec(skb->data + offset, from, copy))
+                        goto fault;
+                if ((len -= copy) == 0)
+                        return 0;
+                offset += copy;
+        }
+
+        /* Copy paged appendix. Hmm... why does this look so complicated? */
+        for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+                int end;
+
+                WARN_ON(start > offset + len);
+
+                end = start + skb_shinfo(skb)->frags[i].size;
+                if ((copy = end - offset) > 0) {
+                        int err;
+                        u8  *vaddr;
+                        skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
+                        struct page *page = frag->page;
+
+                        if (copy > len)
+                                copy = len;
+                        vaddr = kmap(page);
+                        err = memcpy_fromiovec(vaddr + frag->page_offset +
+                                               offset - start, from, copy);
+                        kunmap(page);
+                        if (err)
+                                goto fault;
+
+                        if (!(len -= copy))
+                                return 0;
+                        offset += copy;
+                }
+                start = end;
+        }
+
+        if (skb_shinfo(skb)->frag_list) {
+                struct sk_buff *list = skb_shinfo(skb)->frag_list;
+
+                for (; list; list = list->next) {
+                        int end;
+
+                        WARN_ON(start > offset + len);
+
+                        end = start + list->len;
+                        if ((copy = end - offset) > 0) {
+                                if (copy > len)
+                                        copy = len;
+                                if (skb_copy_datagram_from_iovec(list,
+                                                                 offset - start,
+                                                                 from, copy))
+                                        goto fault;
+                                if ((len -= copy) == 0)
+                                        return 0;
+                                offset += copy;
+                        }
+                        start = end;
+                }
+        }
+        if (!len)
+                return 0;
+
+fault:
+        return -EFAULT;
+}
+EXPORT_SYMBOL(skb_copy_datagram_from_iovec);
+
 static int skb_copy_and_csum_datagram(const struct sk_buff *skb, int offset,
                                       u8 __user *to, int len,
                                       __wsum *csump)
diff --git a/net/core/dev.c b/net/core/dev.c
index 600bb23c4c2e..60c51f765887 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1339,19 +1339,23 @@ static void dev_queue_xmit_nit(struct sk_buff *skb, struct net_device *dev)
 }
 
 
-void __netif_schedule(struct Qdisc *q)
+static inline void __netif_reschedule(struct Qdisc *q)
 {
-        if (!test_and_set_bit(__QDISC_STATE_SCHED, &q->state)) {
-                struct softnet_data *sd;
-                unsigned long flags;
+        struct softnet_data *sd;
+        unsigned long flags;
 
-                local_irq_save(flags);
-                sd = &__get_cpu_var(softnet_data);
-                q->next_sched = sd->output_queue;
-                sd->output_queue = q;
-                raise_softirq_irqoff(NET_TX_SOFTIRQ);
-                local_irq_restore(flags);
-        }
+        local_irq_save(flags);
+        sd = &__get_cpu_var(softnet_data);
+        q->next_sched = sd->output_queue;
+        sd->output_queue = q;
+        raise_softirq_irqoff(NET_TX_SOFTIRQ);
+        local_irq_restore(flags);
+}
+
+void __netif_schedule(struct Qdisc *q)
+{
+        if (!test_and_set_bit(__QDISC_STATE_SCHED, &q->state))
+                __netif_reschedule(q);
 }
 EXPORT_SYMBOL(__netif_schedule);
 
@@ -1800,9 +1804,13 @@ gso:
 
                 spin_lock(root_lock);
 
-                rc = qdisc_enqueue_root(skb, q);
-                qdisc_run(q);
-
+                if (unlikely(test_bit(__QDISC_STATE_DEACTIVATED, &q->state))) {
+                        kfree_skb(skb);
+                        rc = NET_XMIT_DROP;
+                } else {
+                        rc = qdisc_enqueue_root(skb, q);
+                        qdisc_run(q);
+                }
                 spin_unlock(root_lock);
 
                 goto out;
@@ -1974,15 +1982,17 @@ static void net_tx_action(struct softirq_action *h)
 
                         head = head->next_sched;
 
-                        smp_mb__before_clear_bit();
-                        clear_bit(__QDISC_STATE_SCHED, &q->state);
-
                         root_lock = qdisc_lock(q);
                         if (spin_trylock(root_lock)) {
+                                smp_mb__before_clear_bit();
+                                clear_bit(__QDISC_STATE_SCHED,
+                                          &q->state);
                                 qdisc_run(q);
                                 spin_unlock(root_lock);
                         } else {
-                                __netif_schedule(q);
+                                if (!test_bit(__QDISC_STATE_DEACTIVATED,
+                                              &q->state))
+                                        __netif_reschedule(q);
                         }
                 }
         }
@@ -2084,7 +2094,8 @@ static int ing_filter(struct sk_buff *skb)
         q = rxq->qdisc;
         if (q != &noop_qdisc) {
                 spin_lock(qdisc_lock(q));
-                result = qdisc_enqueue_root(skb, q);
+                if (likely(!test_bit(__QDISC_STATE_DEACTIVATED, &q->state)))
+                        result = qdisc_enqueue_root(skb, q);
                 spin_unlock(qdisc_lock(q));
         }
 
diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
index a89f32fa94f6..57abe8266be1 100644
--- a/net/core/gen_estimator.c
+++ b/net/core/gen_estimator.c
@@ -99,7 +99,7 @@ struct gen_estimator_head
 
 static struct gen_estimator_head elist[EST_MAX_INTERVAL+1];
 
-/* Protects against NULL dereference and RCU write-side */
+/* Protects against NULL dereference */
 static DEFINE_RWLOCK(est_lock);
 
 static void est_timer(unsigned long arg)
@@ -185,7 +185,6 @@ int gen_new_estimator(struct gnet_stats_basic *bstats,
         est->last_packets = bstats->packets;
         est->avpps = rate_est->pps<<10;
 
-        write_lock_bh(&est_lock);
         if (!elist[idx].timer.function) {
                 INIT_LIST_HEAD(&elist[idx].list);
                 setup_timer(&elist[idx].timer, est_timer, idx);
@@ -195,7 +194,6 @@ int gen_new_estimator(struct gnet_stats_basic *bstats,
                 mod_timer(&elist[idx].timer, jiffies + ((HZ/4) << idx));
 
         list_add_rcu(&est->list, &elist[idx].list);
-        write_unlock_bh(&est_lock);
         return 0;
 }
 
@@ -214,6 +212,7 @@ static void __gen_kill_estimator(struct rcu_head *head)
  * Removes the rate estimator specified by &bstats and &rate_est
  * and deletes the timer.
  *
+ * NOTE: Called under rtnl_mutex
  */
 void gen_kill_estimator(struct gnet_stats_basic *bstats,
         struct gnet_stats_rate_est *rate_est)
@@ -227,17 +226,17 @@ void gen_kill_estimator(struct gnet_stats_basic *bstats,
                 if (!elist[idx].timer.function)
                         continue;
 
-                write_lock_bh(&est_lock);
                 list_for_each_entry_safe(e, n, &elist[idx].list, list) {
                         if (e->rate_est != rate_est || e->bstats != bstats)
                                 continue;
 
+                        write_lock_bh(&est_lock);
                         e->bstats = NULL;
+                        write_unlock_bh(&est_lock);
 
                         list_del_rcu(&e->list);
                         call_rcu(&e->e_rcu, __gen_kill_estimator);
                 }
-                write_unlock_bh(&est_lock);
         }
 }
 
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 84640172d65d..ca1ccdf1ef76 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2256,14 +2256,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, int features)
                         segs = nskb;
                 tail = nskb;
 
-                nskb->dev = skb->dev;
-                skb_copy_queue_mapping(nskb, skb);
-                nskb->priority = skb->priority;
-                nskb->protocol = skb->protocol;
-                nskb->vlan_tci = skb->vlan_tci;
-                nskb->dst = dst_clone(skb->dst);
-                memcpy(nskb->cb, skb->cb, sizeof(skb->cb));
-                nskb->pkt_type = skb->pkt_type;
+                __copy_skb_header(nskb, skb);
                 nskb->mac_len = skb->mac_len;
 
                 skb_reserve(nskb, headroom);
@@ -2274,6 +2267,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, int features)
                 skb_copy_from_linear_data(skb, skb_put(nskb, doffset),
                                           doffset);
                 if (!sg) {
+                        nskb->ip_summed = CHECKSUM_NONE;
                         nskb->csum = skb_copy_and_csum_bits(skb, offset,
                                                             skb_put(nskb, len),
                                                             len, 0);
@@ -2283,8 +2277,6 @@ struct sk_buff *skb_segment(struct sk_buff *skb, int features)
                 frag = skb_shinfo(nskb)->frags;
                 k = 0;
 
-                nskb->ip_summed = CHECKSUM_PARTIAL;
-                nskb->csum = skb->csum;
                 skb_copy_from_linear_data_offset(skb, offset,
                                                  skb_put(nskb, hsize), hsize);
 
diff --git a/net/dccp/input.c b/net/dccp/input.c
index df2f110df94a..803933ab396d 100644
--- a/net/dccp/input.c
+++ b/net/dccp/input.c
@@ -411,12 +411,6 @@ static int dccp_rcv_request_sent_state_process(struct sock *sk,
                 struct dccp_sock *dp = dccp_sk(sk);
                 long tstamp = dccp_timestamp();
 
-                /* Stop the REQUEST timer */
-                inet_csk_clear_xmit_timer(sk, ICSK_TIME_RETRANS);
-                WARN_ON(sk->sk_send_head == NULL);
-                __kfree_skb(sk->sk_send_head);
-                sk->sk_send_head = NULL;
-
                 if (!between48(DCCP_SKB_CB(skb)->dccpd_ack_seq,
                                dp->dccps_awl, dp->dccps_awh)) {
                         dccp_pr_debug("invalid ackno: S.AWL=%llu, "
@@ -441,6 +435,12 @@ static int dccp_rcv_request_sent_state_process(struct sock *sk,
                                     DCCP_ACKVEC_STATE_RECEIVED))
                         goto out_invalid_packet; /* FIXME: change error code */
 
+                /* Stop the REQUEST timer */
+                inet_csk_clear_xmit_timer(sk, ICSK_TIME_RETRANS);
+                WARN_ON(sk->sk_send_head == NULL);
+                kfree_skb(sk->sk_send_head);
+                sk->sk_send_head = NULL;
+
                 dp->dccps_isr = DCCP_SKB_CB(skb)->dccpd_seq;
                 dccp_update_gsr(sk, dp->dccps_isr);
                 /*
diff --git a/net/ipv4/netfilter/ipt_addrtype.c b/net/ipv4/netfilter/ipt_addrtype.c
index 49587a497229..462a22c97877 100644
--- a/net/ipv4/netfilter/ipt_addrtype.c
+++ b/net/ipv4/netfilter/ipt_addrtype.c
@@ -70,7 +70,7 @@ addrtype_mt_v1(const struct sk_buff *skb, const struct net_device *in,
                        (info->flags & IPT_ADDRTYPE_INVERT_SOURCE);
         if (ret && info->dest)
                 ret &= match_type(dev, iph->daddr, info->dest) ^
-                       (info->flags & IPT_ADDRTYPE_INVERT_DEST);
+                       !!(info->flags & IPT_ADDRTYPE_INVERT_DEST);
         return ret;
 }
 
diff --git a/net/ipv4/netfilter/nf_nat_proto_common.c b/net/ipv4/netfilter/nf_nat_proto_common.c
index 91537f11273f..6c4f11f51446 100644
--- a/net/ipv4/netfilter/nf_nat_proto_common.c
+++ b/net/ipv4/netfilter/nf_nat_proto_common.c
@@ -73,9 +73,13 @@ bool nf_nat_proto_unique_tuple(struct nf_conntrack_tuple *tuple,
                 range_size = ntohs(range->max.all) - min + 1;
         }
 
-        off = *rover;
         if (range->flags & IP_NAT_RANGE_PROTO_RANDOM)
-                off = net_random();
+                off = secure_ipv4_port_ephemeral(tuple->src.u3.ip, tuple->dst.u3.ip,
+                                                 maniptype == IP_NAT_MANIP_SRC
+                                                 ? tuple->dst.u.all
+                                                 : tuple->src.u.all);
+        else
+                off = *rover;
 
         for (i = 0; i < range_size; i++, off++) {
                 *portptr = htons(min + off % range_size);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 16fc6f454a31..cca921ea8550 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2914,6 +2914,68 @@ static int ipv4_sysctl_rtcache_flush_strategy(ctl_table *table,
         return 0;
 }
 
+static void rt_secret_reschedule(int old)
+{
+        struct net *net;
+        int new = ip_rt_secret_interval;
+        int diff = new - old;
+
+        if (!diff)
+                return;
+
+        rtnl_lock();
+        for_each_net(net) {
+                int deleted = del_timer_sync(&net->ipv4.rt_secret_timer);
+
+                if (!new)
+                        continue;
+
+                if (deleted) {
+                        long time = net->ipv4.rt_secret_timer.expires - jiffies;
+
+                        if (time <= 0 || (time += diff) <= 0)
+                                time = 0;
+
+                        net->ipv4.rt_secret_timer.expires = time;
+                } else
+                        net->ipv4.rt_secret_timer.expires = new;
+
+                net->ipv4.rt_secret_timer.expires += jiffies;
+                add_timer(&net->ipv4.rt_secret_timer);
+        }
+        rtnl_unlock();
+}
+
+static int ipv4_sysctl_rt_secret_interval(ctl_table *ctl, int write,
+                                          struct file *filp,
+                                          void __user *buffer, size_t *lenp,
+                                          loff_t *ppos)
+{
+        int old = ip_rt_secret_interval;
+        int ret = proc_dointvec_jiffies(ctl, write, filp, buffer, lenp, ppos);
+
+        rt_secret_reschedule(old);
+
+        return ret;
+}
+
+static int ipv4_sysctl_rt_secret_interval_strategy(ctl_table *table,
+                                                   int __user *name,
+                                                   int nlen,
+                                                   void __user *oldval,
+                                                   size_t __user *oldlenp,
+                                                   void __user *newval,
+                                                   size_t newlen)
+{
+        int old = ip_rt_secret_interval;
+        int ret = sysctl_jiffies(table, name, nlen, oldval, oldlenp, newval,
+                                 newlen);
+
+        rt_secret_reschedule(old);
+
+        return ret;
+}
+
 static ctl_table ipv4_route_table[] = {
         {
                 .ctl_name       = NET_IPV4_ROUTE_GC_THRESH,
@@ -3048,8 +3110,8 @@ static ctl_table ipv4_route_table[] = {
                 .data           = &ip_rt_secret_interval,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
-                .strategy       = &sysctl_jiffies,
+                .proc_handler   = &ipv4_sysctl_rt_secret_interval,
+                .strategy       = &ipv4_sysctl_rt_secret_interval_strategy,
         },
         { .ctl_name = 0 }
 };
@@ -3126,10 +3188,12 @@ static __net_init int rt_secret_timer_init(struct net *net)
         net->ipv4.rt_secret_timer.data = (unsigned long)net;
         init_timer_deferrable(&net->ipv4.rt_secret_timer);
 
-        net->ipv4.rt_secret_timer.expires =
-                jiffies + net_random() % ip_rt_secret_interval +
-                ip_rt_secret_interval;
-        add_timer(&net->ipv4.rt_secret_timer);
+        if (ip_rt_secret_interval) {
+                net->ipv4.rt_secret_timer.expires =
+                        jiffies + net_random() % ip_rt_secret_interval +
+                        ip_rt_secret_interval;
+                add_timer(&net->ipv4.rt_secret_timer);
+        }
         return 0;
 }
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index a7842c54f58a..e2d3b7580b76 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1106,13 +1106,12 @@ out:
         return ret;
 }
 
-int ipv6_dev_get_saddr(struct net_device *dst_dev,
+int ipv6_dev_get_saddr(struct net *net, struct net_device *dst_dev,
                        const struct in6_addr *daddr, unsigned int prefs,
                        struct in6_addr *saddr)
 {
         struct ipv6_saddr_score scores[2],
                                 *score = &scores[0], *hiscore = &scores[1];
-        struct net *net = dev_net(dst_dev);
         struct ipv6_saddr_dst dst;
         struct net_device *dev;
         int dst_type;
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index 8d05527524e3..f5de3f9dc692 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -93,7 +93,8 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
                         if (flags & RT6_LOOKUP_F_SRCPREF_COA)
                                 srcprefs |= IPV6_PREFER_SRC_COA;
 
-                        if (ipv6_dev_get_saddr(ip6_dst_idev(&rt->u.dst)->dev,
+                        if (ipv6_dev_get_saddr(net,
+                                               ip6_dst_idev(&rt->u.dst)->dev,
                                                &flp->fl6_dst, srcprefs,
                                                &saddr))
                                 goto again;
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 52dddc25d3e6..29c7c99e69f7 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -378,6 +378,7 @@ static int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
 
         arg.skb = skb;
         arg.cb = cb;
+        arg.net = net;
         w->args = &arg;
 
         for (h = s_h; h < FIB_TABLE_HASHSZ; h++, s_e = 0) {
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index a4402de425d9..0e844c2736a7 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -934,7 +934,7 @@ static int ip6_dst_lookup_tail(struct sock *sk,
                 goto out_err_release;
 
         if (ipv6_addr_any(&fl->fl6_src)) {
-                err = ipv6_dev_get_saddr(ip6_dst_idev(*dst)->dev,
+                err = ipv6_dev_get_saddr(net, ip6_dst_idev(*dst)->dev,
                                          &fl->fl6_dst,
                                          sk ? inet6_sk(sk)->srcprefs : 0,
                                          &fl->fl6_src);
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 741cfcd96f88..4e5eac301f91 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -911,7 +911,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
                 } else {
                         if (np->rxopt.bits.rxinfo) {
                                 struct in6_pktinfo src_info;
-                                src_info.ipi6_ifindex = np->mcast_oif;
+                                src_info.ipi6_ifindex = np->mcast_oif ? np->mcast_oif : sk->sk_bound_dev_if;
                                 ipv6_addr_copy(&src_info.ipi6_addr, &np->daddr);
                                 put_cmsg(&msg, SOL_IPV6, IPV6_PKTINFO, sizeof(src_info), &src_info);
                         }
@@ -921,7 +921,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
                         }
                         if (np->rxopt.bits.rxoinfo) {
                                 struct in6_pktinfo src_info;
-                                src_info.ipi6_ifindex = np->mcast_oif;
+                                src_info.ipi6_ifindex = np->mcast_oif ? np->mcast_oif : sk->sk_bound_dev_if;
                                 ipv6_addr_copy(&src_info.ipi6_addr, &np->daddr);
                                 put_cmsg(&msg, SOL_IPV6, IPV6_2292PKTINFO, sizeof(src_info), &src_info);
                         }
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index beb48e3f038a..f1c62ba0f56b 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -549,7 +549,7 @@ static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
                         override = 0;
                 in6_ifa_put(ifp);
         } else {
-                if (ipv6_dev_get_saddr(dev, daddr,
+                if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr,
                                        inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs,
                                        &tmpaddr))
                         return;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 41b165ffb369..9af6115f0f50 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2106,7 +2106,8 @@ static inline size_t rt6_nlmsg_size(void)
                + nla_total_size(sizeof(struct rta_cacheinfo));
 }
 
-static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt,
+static int rt6_fill_node(struct net *net,
+                         struct sk_buff *skb, struct rt6_info *rt,
                          struct in6_addr *dst, struct in6_addr *src,
                          int iif, int type, u32 pid, u32 seq,
                          int prefix, int nowait, unsigned int flags)
@@ -2189,7 +2190,7 @@ static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt,
         } else if (dst) {
                 struct inet6_dev *idev = ip6_dst_idev(&rt->u.dst);
                 struct in6_addr saddr_buf;
-                if (ipv6_dev_get_saddr(idev ? idev->dev : NULL,
+                if (ipv6_dev_get_saddr(net, idev ? idev->dev : NULL,
                                        dst, 0, &saddr_buf) == 0)
                         NLA_PUT(skb, RTA_PREFSRC, 16, &saddr_buf);
         }
@@ -2234,7 +2235,8 @@ int rt6_dump_route(struct rt6_info *rt, void *p_arg)
         } else
                 prefix = 0;
 
-        return rt6_fill_node(arg->skb, rt, NULL, NULL, 0, RTM_NEWROUTE,
+        return rt6_fill_node(arg->net,
+                     arg->skb, rt, NULL, NULL, 0, RTM_NEWROUTE,
                      NETLINK_CB(arg->cb->skb).pid, arg->cb->nlh->nlmsg_seq,
                      prefix, 0, NLM_F_MULTI);
 }
@@ -2300,7 +2302,7 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void
         rt = (struct rt6_info*) ip6_route_output(net, NULL, &fl);
         skb->dst = &rt->u.dst;
 
-        err = rt6_fill_node(skb, rt, &fl.fl6_dst, &fl.fl6_src, iif,
+        err = rt6_fill_node(net, skb, rt, &fl.fl6_dst, &fl.fl6_src, iif,
                             RTM_NEWROUTE, NETLINK_CB(in_skb).pid,
                             nlh->nlmsg_seq, 0, 0, 0);
         if (err < 0) {
@@ -2327,7 +2329,7 @@ void inet6_rt_notify(int event, struct rt6_info *rt, struct nl_info *info)
         if (skb == NULL)
                 goto errout;
 
-        err = rt6_fill_node(skb, rt, NULL, NULL, 0,
+        err = rt6_fill_node(net, skb, rt, NULL, NULL, 0,
                                 event, info->pid, seq, 0, 0, 0);
         if (err < 0) {
                 /* -EMSGSIZE implies BUG in rt6_nlmsg_size() */
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 8f1e0543b3c4..08e4cbbe3f04 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -52,12 +52,14 @@ static struct dst_entry *xfrm6_dst_lookup(int tos, xfrm_address_t *saddr,
 static int xfrm6_get_saddr(xfrm_address_t *saddr, xfrm_address_t *daddr)
 {
         struct dst_entry *dst;
+        struct net_device *dev;
 
         dst = xfrm6_dst_lookup(0, NULL, daddr);
         if (IS_ERR(dst))
                 return -EHOSTUNREACH;
 
-        ipv6_dev_get_saddr(ip6_dst_idev(dst)->dev,
+        dev = ip6_dst_idev(dst)->dev;
+        ipv6_dev_get_saddr(dev_net(dev), dev,
                            (struct in6_addr *)&daddr->a6, 0,
                            (struct in6_addr *)&saddr->a6);
         dst_release(dst);
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index e1d11c9b6729..1e97fb9fb34b 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -2103,6 +2103,8 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                         rcu_read_unlock();
                         return;
                 }
+                /* update new sta with its last rx activity */
+                sta->last_rx = jiffies;
         }
 
         /*
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 105a616c5c78..a8752031adcb 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -968,7 +968,7 @@ ctnetlink_change_helper(struct nf_conn *ct, struct nlattr *cda[])
                 /* need to zero data of old helper */
                 memset(&help->help, 0, sizeof(help->help));
         } else {
-                help = nf_ct_helper_ext_add(ct, GFP_KERNEL);
+                help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
                 if (help == NULL)
                         return -ENOMEM;
         }
@@ -1136,16 +1136,33 @@ ctnetlink_create_conntrack(struct nlattr *cda[],
         ct->timeout.expires = jiffies + ct->timeout.expires * HZ;
         ct->status |= IPS_CONFIRMED;
 
+        rcu_read_lock();
+        helper = __nf_ct_helper_find(rtuple);
+        if (helper) {
+                help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
+                if (help == NULL) {
+                        rcu_read_unlock();
+                        err = -ENOMEM;
+                        goto err;
+                }
+                /* not in hash table yet so not strictly necessary */
+                rcu_assign_pointer(help->helper, helper);
+        }
+
         if (cda[CTA_STATUS]) {
                 err = ctnetlink_change_status(ct, cda);
-                if (err < 0)
+                if (err < 0) {
+                        rcu_read_unlock();
                         goto err;
+                }
         }
 
         if (cda[CTA_PROTOINFO]) {
                 err = ctnetlink_change_protoinfo(ct, cda);
-                if (err < 0)
+                if (err < 0) {
+                        rcu_read_unlock();
                         goto err;
+                }
         }
 
         nf_ct_acct_ext_add(ct, GFP_KERNEL);
@@ -1155,19 +1172,6 @@ ctnetlink_create_conntrack(struct nlattr *cda[],
                 ct->mark = ntohl(nla_get_be32(cda[CTA_MARK]));
 #endif
 
-        rcu_read_lock();
-        helper = __nf_ct_helper_find(rtuple);
-        if (helper) {
-                help = nf_ct_helper_ext_add(ct, GFP_KERNEL);
-                if (help == NULL) {
-                        rcu_read_unlock();
-                        err = -ENOMEM;
-                        goto err;
-                }
-                /* not in hash table yet so not strictly necessary */
-                rcu_assign_pointer(help->helper, helper);
-        }
-
         /* setup master conntrack: this is a confirmed expectation */
         if (master_ct) {
                 __set_bit(IPS_EXPECTED_BIT, &ct->status);
diff --git a/net/rfkill/rfkill.c b/net/rfkill/rfkill.c
index d2d45655cd1a..35a9994e2339 100644
--- a/net/rfkill/rfkill.c
+++ b/net/rfkill/rfkill.c
@@ -150,6 +150,8 @@ static void update_rfkill_state(struct rfkill *rfkill)
  * calls and handling all the red tape such as issuing notifications
  * if the call is successful.
  *
+ * Suspended devices are not touched at all, and -EAGAIN is returned.
+ *
  * Note that the @force parameter cannot override a (possibly cached)
  * state of RFKILL_STATE_HARD_BLOCKED.  Any device making use of
  * RFKILL_STATE_HARD_BLOCKED implements either get_state() or
@@ -168,6 +170,9 @@ static int rfkill_toggle_radio(struct rfkill *rfkill,
         int retval = 0;
         enum rfkill_state oldstate, newstate;
 
+        if (unlikely(rfkill->dev.power.power_state.event & PM_EVENT_SLEEP))
+                return -EBUSY;
+
         oldstate = rfkill->state;
 
         if (rfkill->get_state && !force &&
@@ -214,7 +219,7 @@ static int rfkill_toggle_radio(struct rfkill *rfkill,
  *
  * This function toggles the state of all switches of given type,
  * unless a specific switch is claimed by userspace (in which case,
- * that switch is left alone).
+ * that switch is left alone) or suspended.
  */
 void rfkill_switch_all(enum rfkill_type type, enum rfkill_state state)
 {
@@ -239,8 +244,8 @@ EXPORT_SYMBOL(rfkill_switch_all);
 /**
  * rfkill_epo - emergency power off all transmitters
  *
- * This kicks all rfkill devices to RFKILL_STATE_SOFT_BLOCKED, ignoring
- * everything in its path but rfkill_mutex and rfkill->mutex.
+ * This kicks all non-suspended rfkill devices to RFKILL_STATE_SOFT_BLOCKED,
+ * ignoring everything in its path but rfkill_mutex and rfkill->mutex.
  */
 void rfkill_epo(void)
 {
@@ -458,13 +463,14 @@ static int rfkill_resume(struct device *dev)
         if (dev->power.power_state.event != PM_EVENT_ON) {
                 mutex_lock(&rfkill->mutex);
 
+                dev->power.power_state.event = PM_EVENT_ON;
+
                 /* restore radio state AND notify everybody */
                 rfkill_toggle_radio(rfkill, rfkill->state, 1);
 
                 mutex_unlock(&rfkill->mutex);
         }
 
-        dev->power.power_state = PMSG_ON;
         return 0;
 }
 #else
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index d2b6f54a6261..5cafdd4c8018 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -280,7 +280,7 @@ replay:
                 if (n->nlmsg_type == RTM_DELTFILTER && t->tcm_handle == 0) {
                         spin_lock_bh(root_lock);
                         *back = tp->next;
-                        spin_lock_bh(root_lock);
+                        spin_unlock_bh(root_lock);
 
                         tfilter_notify(skb, n, tp, fh, RTM_DELTFILTER);
                         tcf_destroy(tp);
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index c25465e5607a..ef0efeca6352 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -27,6 +27,7 @@
 #include <linux/kmod.h>
 #include <linux/list.h>
 #include <linux/hrtimer.h>
+#include <linux/lockdep.h>
 
 #include <net/net_namespace.h>
 #include <net/sock.h>
@@ -331,7 +332,7 @@ static struct qdisc_size_table *qdisc_get_stab(struct nlattr *opt)
         if (!s || tsize != s->tsize || (!tab && tsize > 0))
                 return ERR_PTR(-EINVAL);
 
-        spin_lock_bh(&qdisc_stab_lock);
+        spin_lock(&qdisc_stab_lock);
 
         list_for_each_entry(stab, &qdisc_stab_list, list) {
                 if (memcmp(&stab->szopts, s, sizeof(*s)))
@@ -339,11 +340,11 @@ static struct qdisc_size_table *qdisc_get_stab(struct nlattr *opt)
                 if (tsize > 0 && memcmp(stab->data, tab, tsize * sizeof(u16)))
                         continue;
                 stab->refcnt++;
-                spin_unlock_bh(&qdisc_stab_lock);
+                spin_unlock(&qdisc_stab_lock);
                 return stab;
         }
 
-        spin_unlock_bh(&qdisc_stab_lock);
+        spin_unlock(&qdisc_stab_lock);
 
         stab = kmalloc(sizeof(*stab) + tsize * sizeof(u16), GFP_KERNEL);
         if (!stab)
@@ -354,9 +355,9 @@ static struct qdisc_size_table *qdisc_get_stab(struct nlattr *opt)
         if (tsize > 0)
                 memcpy(stab->data, tab, tsize * sizeof(u16));
 
-        spin_lock_bh(&qdisc_stab_lock);
+        spin_lock(&qdisc_stab_lock);
         list_add_tail(&stab->list, &qdisc_stab_list);
-        spin_unlock_bh(&qdisc_stab_lock);
+        spin_unlock(&qdisc_stab_lock);
 
         return stab;
 }
@@ -366,14 +367,14 @@ void qdisc_put_stab(struct qdisc_size_table *tab)
         if (!tab)
                 return;
 
-        spin_lock_bh(&qdisc_stab_lock);
+        spin_lock(&qdisc_stab_lock);
 
         if (--tab->refcnt == 0) {
                 list_del(&tab->list);
                 kfree(tab);
         }
 
-        spin_unlock_bh(&qdisc_stab_lock);
+        spin_unlock(&qdisc_stab_lock);
 }
 EXPORT_SYMBOL(qdisc_put_stab);
 
@@ -426,7 +427,7 @@ static enum hrtimer_restart qdisc_watchdog(struct hrtimer *timer)
 
         wd->qdisc->flags &= ~TCQ_F_THROTTLED;
         smp_wmb();
-        __netif_schedule(wd->qdisc);
+        __netif_schedule(qdisc_root(wd->qdisc));
 
         return HRTIMER_NORESTART;
 }
@@ -637,11 +638,8 @@ static void notify_and_destroy(struct sk_buff *skb, struct nlmsghdr *n, u32 clid
         if (new || old)
                 qdisc_notify(skb, n, clid, old, new);
 
-        if (old) {
-                spin_lock_bh(&old->q.lock);
+        if (old)
                 qdisc_destroy(old);
-                spin_unlock_bh(&old->q.lock);
-        }
 }
 
 /* Graft qdisc "new" to class "classid" of qdisc "parent" or
@@ -707,6 +705,10 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,
         return err;
 }
 
+/* lockdep annotation is needed for ingress; egress gets it only for name */
+static struct lock_class_key qdisc_tx_lock;
+static struct lock_class_key qdisc_rx_lock;
+
 /*
    Allocate and initialize new qdisc.
 
@@ -767,6 +769,7 @@ qdisc_create(struct net_device *dev, struct netdev_queue *dev_queue,
         if (handle == TC_H_INGRESS) {
                 sch->flags |= TCQ_F_INGRESS;
                 handle = TC_H_MAKE(TC_H_INGRESS, 0);
+                lockdep_set_class(qdisc_lock(sch), &qdisc_rx_lock);
         } else {
                 if (handle == 0) {
                         handle = qdisc_alloc_handle(dev);
@@ -774,6 +777,7 @@ qdisc_create(struct net_device *dev, struct netdev_queue *dev_queue,
                         if (handle == 0)
                                 goto err_out3;
                 }
+                lockdep_set_class(qdisc_lock(sch), &qdisc_tx_lock);
         }
 
         sch->handle = handle;
@@ -1084,20 +1088,13 @@ create_n_graft:
         }
 
 graft:
-        if (1) {
-                spinlock_t *root_lock;
-
-                err = qdisc_graft(dev, p, skb, n, clid, q, NULL);
-                if (err) {
-                        if (q) {
-                                root_lock = qdisc_root_lock(q);
-                                spin_lock_bh(root_lock);
-                                qdisc_destroy(q);
-                                spin_unlock_bh(root_lock);
-                        }
-                        return err;
-                }
+        err = qdisc_graft(dev, p, skb, n, clid, q, NULL);
+        if (err) {
+                if (q)
+                        qdisc_destroy(q);
+                return err;
         }
+
         return 0;
 }
 
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 4e261ce62f48..47ef492c4ff4 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -654,7 +654,7 @@ static enum hrtimer_restart cbq_undelay(struct hrtimer *timer)
         }
 
         sch->flags &= ~TCQ_F_THROTTLED;
-        __netif_schedule(sch);
+        __netif_schedule(qdisc_root(sch));
         return HRTIMER_NORESTART;
 }
 
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 468574682caa..c3ed4d44fc14 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -518,14 +518,17 @@ void qdisc_reset(struct Qdisc *qdisc)
 }
 EXPORT_SYMBOL(qdisc_reset);
 
-/* this is the rcu callback function to clean up a qdisc when there
- * are no further references to it */
-
-static void __qdisc_destroy(struct rcu_head *head)
+void qdisc_destroy(struct Qdisc *qdisc)
 {
-        struct Qdisc *qdisc = container_of(head, struct Qdisc, q_rcu);
         const struct Qdisc_ops  *ops = qdisc->ops;
 
+        if (qdisc->flags & TCQ_F_BUILTIN ||
+            !atomic_dec_and_test(&qdisc->refcnt))
+                return;
+
+        if (qdisc->parent)
+                list_del(&qdisc->list);
+
 #ifdef CONFIG_NET_SCHED
         qdisc_put_stab(qdisc->stab);
 #endif
@@ -542,20 +545,6 @@ static void __qdisc_destroy(struct rcu_head *head)
 
         kfree((char *) qdisc - qdisc->padded);
 }
-
-/* Under qdisc_lock(qdisc) and BH! */
-
-void qdisc_destroy(struct Qdisc *qdisc)
-{
-        if (qdisc->flags & TCQ_F_BUILTIN ||
-            !atomic_dec_and_test(&qdisc->refcnt))
-                return;
-
-        if (qdisc->parent)
-                list_del(&qdisc->list);
-
-        call_rcu(&qdisc->q_rcu, __qdisc_destroy);
-}
 EXPORT_SYMBOL(qdisc_destroy);
 
 static bool dev_all_qdisc_sleeping_noop(struct net_device *dev)
@@ -597,6 +586,9 @@ static void transition_one_qdisc(struct net_device *dev,
         struct Qdisc *new_qdisc = dev_queue->qdisc_sleeping;
         int *need_watchdog_p = _need_watchdog;
 
+        if (!(new_qdisc->flags & TCQ_F_BUILTIN))
+                clear_bit(__QDISC_STATE_DEACTIVATED, &new_qdisc->state);
+
         rcu_assign_pointer(dev_queue->qdisc, new_qdisc);
         if (need_watchdog_p && new_qdisc != &noqueue_qdisc)
                 *need_watchdog_p = 1;
@@ -640,6 +632,9 @@ static void dev_deactivate_queue(struct net_device *dev,
         if (qdisc) {
                 spin_lock_bh(qdisc_lock(qdisc));
 
+                if (!(qdisc->flags & TCQ_F_BUILTIN))
+                        set_bit(__QDISC_STATE_DEACTIVATED, &qdisc->state);
+
                 dev_queue->qdisc = qdisc_default;
                 qdisc_reset(qdisc);
 
@@ -647,7 +642,7 @@ static void dev_deactivate_queue(struct net_device *dev,
         }
 }
 
-static bool some_qdisc_is_busy(struct net_device *dev, int lock)
+static bool some_qdisc_is_busy(struct net_device *dev)
 {
         unsigned int i;
 
@@ -661,14 +656,12 @@ static bool some_qdisc_is_busy(struct net_device *dev, int lock)
                 q = dev_queue->qdisc_sleeping;
                 root_lock = qdisc_lock(q);
 
-                if (lock)
-                        spin_lock_bh(root_lock);
+                spin_lock_bh(root_lock);
 
                 val = (test_bit(__QDISC_STATE_RUNNING, &q->state) ||
                        test_bit(__QDISC_STATE_SCHED, &q->state));
 
-                if (lock)
-                        spin_unlock_bh(root_lock);
+                spin_unlock_bh(root_lock);
 
                 if (val)
                         return true;
@@ -678,8 +671,6 @@ static bool some_qdisc_is_busy(struct net_device *dev, int lock)
 
 void dev_deactivate(struct net_device *dev)
 {
-        bool running;
-
         netdev_for_each_tx_queue(dev, dev_deactivate_queue, &noop_qdisc);
         dev_deactivate_queue(dev, &dev->rx_queue, &noop_qdisc);
 
@@ -689,25 +680,8 @@ void dev_deactivate(struct net_device *dev)
         synchronize_rcu();
 
         /* Wait for outstanding qdisc_run calls. */
-        do {
-                while (some_qdisc_is_busy(dev, 0))
-                        yield();
-
-                /*
-                 * Double-check inside queue lock to ensure that all effects
-                 * of the queue run are visible when we return.
-                 */
-                running = some_qdisc_is_busy(dev, 1);
-
-                /*
-                 * The running flag should never be set at this point because
-                 * we've already set dev->qdisc to noop_qdisc *inside* the same
-                 * pair of spin locks.  That is, if any qdisc_run starts after
-                 * our initial test it should see the noop_qdisc and then
-                 * clear the RUNNING bit before dropping the queue lock.  So
-                 * if it is set here then we've found a bug.
-                 */
-        } while (WARN_ON_ONCE(running));
+        while (some_qdisc_is_busy(dev))
+                yield();
 }
 
 static void dev_init_scheduler_queue(struct net_device *dev,
@@ -736,14 +710,10 @@ static void shutdown_scheduler_queue(struct net_device *dev,
         struct Qdisc *qdisc_default = _qdisc_default;
 
         if (qdisc) {
-                spinlock_t *root_lock = qdisc_lock(qdisc);
-
                 dev_queue->qdisc = qdisc_default;
                 dev_queue->qdisc_sleeping = qdisc_default;
 
-                spin_lock_bh(root_lock);
                 qdisc_destroy(qdisc);
-                spin_unlock_bh(root_lock);
         }
 }
 
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 6febd245e62b..0df0df202ed0 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -577,7 +577,7 @@ static int htb_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                         sch->qstats.drops++;
                         cl->qstats.drops++;
                 }
-                return NET_XMIT_DROP;
+                return ret;
         } else {
                 cl->bstats.packets +=
                         skb_is_gso(skb)?skb_shinfo(skb)->gso_segs:1;
@@ -623,7 +623,7 @@ static int htb_requeue(struct sk_buff *skb, struct Qdisc *sch)
                         sch->qstats.drops++;
                         cl->qstats.drops++;
                 }
-                return NET_XMIT_DROP;
+                return ret;
         } else
                 htb_activate(q, cl);
 
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index eac197610edf..a6697c686c7f 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -113,11 +113,11 @@ prio_requeue(struct sk_buff *skb, struct Qdisc* sch)
         if ((ret = qdisc->ops->requeue(skb, qdisc)) == NET_XMIT_SUCCESS) {
                 sch->q.qlen++;
                 sch->qstats.requeues++;
-                return 0;
+                return NET_XMIT_SUCCESS;
         }
         if (net_xmit_drop_count(ret))
                 sch->qstats.drops++;
-        return NET_XMIT_DROP;
+        return ret;
 }
 
 
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index 7d3b7ff3bf07..94c61598b86a 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -123,15 +123,8 @@ static int tbf_enqueue(struct sk_buff *skb, struct Qdisc* sch)
         struct tbf_sched_data *q = qdisc_priv(sch);
         int ret;
 
-        if (qdisc_pkt_len(skb) > q->max_size) {
-                sch->qstats.drops++;
-#ifdef CONFIG_NET_CLS_ACT
-                if (sch->reshape_fail == NULL || sch->reshape_fail(skb, sch))
-#endif
-                        kfree_skb(skb);
-
-                return NET_XMIT_DROP;
-        }
+        if (qdisc_pkt_len(skb) > q->max_size)
+                return qdisc_reshape_fail(skb, sch);
 
         ret = qdisc_enqueue(skb, q->qdisc);
         if (ret != 0) {
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 483a01d0740a..47f91afa0211 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -319,7 +319,8 @@ static void sctp_v6_get_saddr(struct sctp_sock *sk,
                           __func__, asoc, dst, NIP6(daddr->v6.sin6_addr));
 
         if (!asoc) {
-                ipv6_dev_get_saddr(dst ? ip6_dst_idev(dst)->dev : NULL,
+                ipv6_dev_get_saddr(sock_net(sctp_opt2sk(sk)),
+                                   dst ? ip6_dst_idev(dst)->dev : NULL,
                                    &daddr->v6.sin6_addr,
                                    inet6_sk(&sk->inet.sk)->srcprefs,
                                    &saddr->v6.sin6_addr);