Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

19 files changed, 128 insertions, 96 deletions

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 845da3ee56a0..9de93714213a 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -55,7 +55,7 @@
 
 #define AUTO_OFF_TIMEOUT 2000
 
-int enable_hs;
+bool enable_hs;
 
 static void hci_rx_work(struct work_struct *work);
 static void hci_cmd_work(struct work_struct *work);
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 921aa2b4b415..369b41894527 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -1311,6 +1311,7 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
         case ETHTOOL_GRXCSUM:
         case ETHTOOL_GTXCSUM:
         case ETHTOOL_GSG:
+        case ETHTOOL_GSSET_INFO:
         case ETHTOOL_GSTRINGS:
         case ETHTOOL_GTSO:
         case ETHTOOL_GPERMADDR:
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 0985b9b14b80..a225089df5b6 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -1,4 +1,5 @@
 #include <linux/skbuff.h>
+#include <linux/export.h>
 #include <linux/ip.h>
 #include <linux/ipv6.h>
 #include <linux/if_vlan.h>
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 65f80c7b1656..4d8ce93cd503 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -767,8 +767,8 @@ done:
         return i;
 }
 
-static unsigned long num_arg(const char __user * user_buffer,
-                             unsigned long maxlen, unsigned long *num)
+static long num_arg(const char __user *user_buffer, unsigned long maxlen,
+                                unsigned long *num)
 {
         int i;
         *num = 0;
diff --git a/net/core/sock.c b/net/core/sock.c
index 5c5af9988f94..3e81fd2e3c75 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1827,7 +1827,7 @@ suppress_allocation:
         /* Alas. Undo changes. */
         sk->sk_forward_alloc -= amt * SK_MEM_QUANTUM;
 
-        sk_memory_allocated_sub(sk, amt, parent_status);
+        sk_memory_allocated_sub(sk, amt);
 
         return 0;
 }
@@ -1840,7 +1840,7 @@ EXPORT_SYMBOL(__sk_mem_schedule);
 void __sk_mem_reclaim(struct sock *sk)
 {
         sk_memory_allocated_sub(sk,
-                                sk->sk_forward_alloc >> SK_MEM_QUANTUM_SHIFT, 0);
+                                sk->sk_forward_alloc >> SK_MEM_QUANTUM_SHIFT);
         sk->sk_forward_alloc &= SK_MEM_QUANTUM - 1;
 
         if (sk_under_memory_pressure(sk) &&
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index 3569d8ecaeac..6afc807ee2ad 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -216,7 +216,6 @@ static const struct snmp_mib snmp4_net_list[] = {
         SNMP_MIB_ITEM("TCPPartialUndo", LINUX_MIB_TCPPARTIALUNDO),
         SNMP_MIB_ITEM("TCPDSACKUndo", LINUX_MIB_TCPDSACKUNDO),
         SNMP_MIB_ITEM("TCPLossUndo", LINUX_MIB_TCPLOSSUNDO),
-        SNMP_MIB_ITEM("TCPLoss", LINUX_MIB_TCPLOSS),
         SNMP_MIB_ITEM("TCPLostRetransmit", LINUX_MIB_TCPLOSTRETRANSMIT),
         SNMP_MIB_ITEM("TCPRenoFailures", LINUX_MIB_TCPRENOFAILURES),
         SNMP_MIB_ITEM("TCPSackFailures", LINUX_MIB_TCPSACKFAILURES),
diff --git a/net/ipv4/tcp_bic.c b/net/ipv4/tcp_bic.c
index 6187eb4d1dcf..f45e1c242440 100644
--- a/net/ipv4/tcp_bic.c
+++ b/net/ipv4/tcp_bic.c
@@ -63,7 +63,6 @@ static inline void bictcp_reset(struct bictcp *ca)
 {
         ca->cnt = 0;
         ca->last_max_cwnd = 0;
-        ca->loss_cwnd = 0;
         ca->last_cwnd = 0;
         ca->last_time = 0;
         ca->epoch_start = 0;
@@ -72,7 +71,11 @@ static inline void bictcp_reset(struct bictcp *ca)
 
 static void bictcp_init(struct sock *sk)
 {
-        bictcp_reset(inet_csk_ca(sk));
+        struct bictcp *ca = inet_csk_ca(sk);
+
+        bictcp_reset(ca);
+        ca->loss_cwnd = 0;
+
         if (initial_ssthresh)
                 tcp_sk(sk)->snd_ssthresh = initial_ssthresh;
 }
@@ -127,7 +130,7 @@ static inline void bictcp_update(struct bictcp *ca, u32 cwnd)
         }
 
         /* if in slow start or link utilization is very low */
-        if (ca->loss_cwnd == 0) {
+        if (ca->last_max_cwnd == 0) {
                 if (ca->cnt > 20) /* increase cwnd 5% per RTT */
                         ca->cnt = 20;
         }
@@ -185,7 +188,7 @@ static u32 bictcp_undo_cwnd(struct sock *sk)
 {
         const struct tcp_sock *tp = tcp_sk(sk);
         const struct bictcp *ca = inet_csk_ca(sk);
-        return max(tp->snd_cwnd, ca->last_max_cwnd);
+        return max(tp->snd_cwnd, ca->loss_cwnd);
 }
 
 static void bictcp_state(struct sock *sk, u8 new_state)
diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c
index f376b05cca81..a9077f441cb2 100644
--- a/net/ipv4/tcp_cubic.c
+++ b/net/ipv4/tcp_cubic.c
@@ -107,7 +107,6 @@ static inline void bictcp_reset(struct bictcp *ca)
 {
         ca->cnt = 0;
         ca->last_max_cwnd = 0;
-        ca->loss_cwnd = 0;
         ca->last_cwnd = 0;
         ca->last_time = 0;
         ca->bic_origin_point = 0;
@@ -142,7 +141,10 @@ static inline void bictcp_hystart_reset(struct sock *sk)
 
 static void bictcp_init(struct sock *sk)
 {
-        bictcp_reset(inet_csk_ca(sk));
+        struct bictcp *ca = inet_csk_ca(sk);
+
+        bictcp_reset(ca);
+        ca->loss_cwnd = 0;
 
         if (hystart)
                 bictcp_hystart_reset(sk);
@@ -275,7 +277,7 @@ static inline void bictcp_update(struct bictcp *ca, u32 cwnd)
          * The initial growth of cubic function may be too conservative
          * when the available bandwidth is still unknown.
          */
-        if (ca->loss_cwnd == 0 && ca->cnt > 20)
+        if (ca->last_max_cwnd == 0 && ca->cnt > 20)
                 ca->cnt = 20;   /* increase cwnd 5% per RTT */
 
         /* TCP Friendly */
@@ -342,7 +344,7 @@ static u32 bictcp_undo_cwnd(struct sock *sk)
 {
         struct bictcp *ca = inet_csk_ca(sk);
 
-        return max(tcp_sk(sk)->snd_cwnd, ca->last_max_cwnd);
+        return max(tcp_sk(sk)->snd_cwnd, ca->loss_cwnd);
 }
 
 static void bictcp_state(struct sock *sk, u8 new_state)
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 2877c3e09587..976034f82320 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -105,7 +105,6 @@ int sysctl_tcp_abc __read_mostly;
 #define FLAG_SYN_ACKED          0x10 /* This ACK acknowledged SYN.              */
 #define FLAG_DATA_SACKED        0x20 /* New SACK.                               */
 #define FLAG_ECE                0x40 /* ECE in this ACK                         */
-#define FLAG_DATA_LOST          0x80 /* SACK detected data lossage.             */
 #define FLAG_SLOWPATH           0x100 /* Do not skip RFC checks for window update.*/
 #define FLAG_ONLY_ORIG_SACKED   0x200 /* SACKs only non-rexmit sent before RTO */
 #define FLAG_SND_UNA_ADVANCED   0x400 /* Snd_una was changed (!= FLAG_DATA_ACKED) */
@@ -1040,13 +1039,11 @@ static void tcp_skb_mark_lost_uncond_verify(struct tcp_sock *tp,
  * These 6 states form finite state machine, controlled by the following events:
  * 1. New ACK (+SACK) arrives. (tcp_sacktag_write_queue())
  * 2. Retransmission. (tcp_retransmit_skb(), tcp_xmit_retransmit_queue())
- * 3. Loss detection event of one of three flavors:
+ * 3. Loss detection event of two flavors:
  *      A. Scoreboard estimator decided the packet is lost.
  *         A'. Reno "three dupacks" marks head of queue lost.
- *         A''. Its FACK modfication, head until snd.fack is lost.
- *      B. SACK arrives sacking data transmitted after never retransmitted
- *         hole was sent out.
- *      C. SACK arrives sacking SND.NXT at the moment, when the
+ *         A''. Its FACK modification, head until snd.fack is lost.
+ *      B. SACK arrives sacking SND.NXT at the moment, when the
  *         segment was retransmitted.
  * 4. D-SACK added new rule: D-SACK changes any tag to S.
  *
@@ -1153,7 +1150,7 @@ static int tcp_is_sackblock_valid(struct tcp_sock *tp, int is_dsack,
 }
 
 /* Check for lost retransmit. This superb idea is borrowed from "ratehalving".
- * Event "C". Later note: FACK people cheated me again 8), we have to account
+ * Event "B". Later note: FACK people cheated me again 8), we have to account
  * for reordering! Ugly, but should help.
  *
  * Search retransmitted skbs from write_queue that were sent when snd_nxt was
@@ -1844,10 +1841,6 @@ tcp_sacktag_write_queue(struct sock *sk, const struct sk_buff *ack_skb,
                 if (found_dup_sack && ((i + 1) == first_sack_index))
                         next_dup = &sp[i + 1];
 
-                /* Event "B" in the comment above. */
-                if (after(end_seq, tp->high_seq))
-                        state.flag |= FLAG_DATA_LOST;
-
                 /* Skip too early cached blocks */
                 while (tcp_sack_cache_ok(tp, cache) &&
                        !before(start_seq, cache->end_seq))
@@ -2515,8 +2508,11 @@ static void tcp_timeout_skbs(struct sock *sk)
         tcp_verify_left_out(tp);
 }
 
-/* Mark head of queue up as lost. With RFC3517 SACK, the packets is
- * is against sacked "cnt", otherwise it's against facked "cnt"
+/* Detect loss in event "A" above by marking head of queue up as lost.
+ * For FACK or non-SACK(Reno) senders, the first "packets" number of segments
+ * are considered lost. For RFC3517 SACK, a segment is considered lost if it
+ * has at least tp->reordering SACKed seqments above it; "packets" refers to
+ * the maximum SACKed segments to pass before reaching this limit.
  */
 static void tcp_mark_head_lost(struct sock *sk, int packets, int mark_head)
 {
@@ -2525,6 +2521,8 @@ static void tcp_mark_head_lost(struct sock *sk, int packets, int mark_head)
         int cnt, oldcnt;
         int err;
         unsigned int mss;
+        /* Use SACK to deduce losses of new sequences sent during recovery */
+        const u32 loss_high = tcp_is_sack(tp) ?  tp->snd_nxt : tp->high_seq;
 
         WARN_ON(packets > tp->packets_out);
         if (tp->lost_skb_hint) {
@@ -2546,7 +2544,7 @@ static void tcp_mark_head_lost(struct sock *sk, int packets, int mark_head)
                 tp->lost_skb_hint = skb;
                 tp->lost_cnt_hint = cnt;
 
-                if (after(TCP_SKB_CB(skb)->end_seq, tp->high_seq))
+                if (after(TCP_SKB_CB(skb)->end_seq, loss_high))
                         break;
 
                 oldcnt = cnt;
@@ -3033,19 +3031,10 @@ static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked,
         if (tcp_check_sack_reneging(sk, flag))
                 return;
 
-        /* C. Process data loss notification, provided it is valid. */
-        if (tcp_is_fack(tp) && (flag & FLAG_DATA_LOST) &&
-            before(tp->snd_una, tp->high_seq) &&
-            icsk->icsk_ca_state != TCP_CA_Open &&
-            tp->fackets_out > tp->reordering) {
-                tcp_mark_head_lost(sk, tp->fackets_out - tp->reordering, 0);
-                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPLOSS);
-        }
-
-        /* D. Check consistency of the current state. */
+        /* C. Check consistency of the current state. */
         tcp_verify_left_out(tp);
 
-        /* E. Check state exit conditions. State can be terminated
+        /* D. Check state exit conditions. State can be terminated
          *    when high_seq is ACKed. */
         if (icsk->icsk_ca_state == TCP_CA_Open) {
                 WARN_ON(tp->retrans_out != 0);
@@ -3077,7 +3066,7 @@ static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked,
                 }
         }
 
-        /* F. Process state. */
+        /* E. Process state. */
         switch (icsk->icsk_ca_state) {
         case TCP_CA_Recovery:
                 if (!(flag & FLAG_SND_UNA_ADVANCED)) {
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 1eb4ad57670e..337ba4cca052 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -631,7 +631,7 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb)
         arg.iov[0].iov_len  = sizeof(rep.th);
 
 #ifdef CONFIG_TCP_MD5SIG
-        key = sk ? tcp_v4_md5_do_lookup(sk, ip_hdr(skb)->daddr) : NULL;
+        key = sk ? tcp_v4_md5_do_lookup(sk, ip_hdr(skb)->saddr) : NULL;
         if (key) {
                 rep.opt[0] = htonl((TCPOPT_NOP << 24) |
                                    (TCPOPT_NOP << 16) |
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index a225d5ee3c2f..c02280a4d126 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -502,29 +502,31 @@ static void addrconf_forward_change(struct net *net, __s32 newf)
         rcu_read_unlock();
 }
 
-static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int old)
+static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int newf)
 {
         struct net *net;
+        int old;
+
+        if (!rtnl_trylock())
+                return restart_syscall();
 
         net = (struct net *)table->extra2;
-        if (p == &net->ipv6.devconf_dflt->forwarding)
-                return 0;
+        old = *p;
+        *p = newf;
 
-        if (!rtnl_trylock()) {
-                /* Restore the original values before restarting */
-                *p = old;
-                return restart_syscall();
+        if (p == &net->ipv6.devconf_dflt->forwarding) {
+                rtnl_unlock();
+                return 0;
         }
 
         if (p == &net->ipv6.devconf_all->forwarding) {
-                __s32 newf = net->ipv6.devconf_all->forwarding;
                 net->ipv6.devconf_dflt->forwarding = newf;
                 addrconf_forward_change(net, newf);
-        } else if ((!*p) ^ (!old))
+        } else if ((!newf) ^ (!old))
                 dev_forward_change((struct inet6_dev *)table->extra1);
         rtnl_unlock();
 
-        if (*p)
+        if (newf)
                 rt6_purge_dflt_routers(net);
         return 1;
 }
@@ -4260,9 +4262,17 @@ int addrconf_sysctl_forward(ctl_table *ctl, int write,
         int *valp = ctl->data;
         int val = *valp;
         loff_t pos = *ppos;
+        ctl_table lctl;
         int ret;
 
-        ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
+        /*
+         * ctl->data points to idev->cnf.forwarding, we should
+         * not modify it until we get the rtnl lock.
+         */
+        lctl = *ctl;
+        lctl.data = &val;
+
+        ret = proc_dointvec(&lctl, write, buffer, lenp, ppos);
 
         if (write)
                 ret = addrconf_fixup_forwarding(ctl, valp, val);
@@ -4300,26 +4310,27 @@ static void addrconf_disable_change(struct net *net, __s32 newf)
         rcu_read_unlock();
 }
 
-static int addrconf_disable_ipv6(struct ctl_table *table, int *p, int old)
+static int addrconf_disable_ipv6(struct ctl_table *table, int *p, int newf)
 {
         struct net *net;
+        int old;
+
+        if (!rtnl_trylock())
+                return restart_syscall();
 
         net = (struct net *)table->extra2;
+        old = *p;
+        *p = newf;
 
-        if (p == &net->ipv6.devconf_dflt->disable_ipv6)
+        if (p == &net->ipv6.devconf_dflt->disable_ipv6) {
+                rtnl_unlock();
                 return 0;
-
-        if (!rtnl_trylock()) {
-                /* Restore the original values before restarting */
-                *p = old;
-                return restart_syscall();
         }
 
         if (p == &net->ipv6.devconf_all->disable_ipv6) {
-                __s32 newf = net->ipv6.devconf_all->disable_ipv6;
                 net->ipv6.devconf_dflt->disable_ipv6 = newf;
                 addrconf_disable_change(net, newf);
-        } else if ((!*p) ^ (!old))
+        } else if ((!newf) ^ (!old))
                 dev_disable_change((struct inet6_dev *)table->extra1);
 
         rtnl_unlock();
@@ -4333,9 +4344,17 @@ int addrconf_sysctl_disable(ctl_table *ctl, int write,
         int *valp = ctl->data;
         int val = *valp;
         loff_t pos = *ppos;
+        ctl_table lctl;
         int ret;
 
-        ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
+        /*
+         * ctl->data points to idev->cnf.disable_ipv6, we should
+         * not modify it until we get the rtnl lock.
+         */
+        lctl = *ctl;
+        lctl.data = &val;
+
+        ret = proc_dointvec(&lctl, write, buffer, lenp, ppos);
 
         if (write)
                 ret = addrconf_disable_ipv6(ctl, valp, val);
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 906c7ca43542..3edd05ae4388 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1083,7 +1083,7 @@ static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
 
 #ifdef CONFIG_TCP_MD5SIG
         if (sk)
-                key = tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr);
+                key = tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->saddr);
 #endif
 
         if (th->ack)
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index a18e6c3d36e3..b9bef2c75026 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -713,6 +713,7 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
         struct sk_buff *skb = NULL;
         struct sock *sk = sock->sk;
         struct llc_sock *llc = llc_sk(sk);
+        unsigned long cpu_flags;
         size_t copied = 0;
         u32 peek_seq = 0;
         u32 *seq;
@@ -838,7 +839,9 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
                         goto copy_uaddr;
 
                 if (!(flags & MSG_PEEK)) {
+                        spin_lock_irqsave(&sk->sk_receive_queue.lock, cpu_flags);
                         sk_eat_skb(sk, skb, 0);
+                        spin_unlock_irqrestore(&sk->sk_receive_queue.lock, cpu_flags);
                         *seq = 0;
                 }
 
@@ -859,7 +862,9 @@ copy_uaddr:
                 llc_cmsg_rcv(msg, skb);
 
         if (!(flags & MSG_PEEK)) {
+                        spin_lock_irqsave(&sk->sk_receive_queue.lock, cpu_flags);
                         sk_eat_skb(sk, skb, 0);
+                        spin_unlock_irqrestore(&sk->sk_receive_queue.lock, cpu_flags);
                         *seq = 0;
         }
 
diff --git a/net/mac80211/debugfs_key.c b/net/mac80211/debugfs_key.c
index 38e6101190d9..59edcd95a58d 100644
--- a/net/mac80211/debugfs_key.c
+++ b/net/mac80211/debugfs_key.c
@@ -225,9 +225,9 @@ KEY_OPS(key);
                             key, &key_##name##_ops);
 
 void ieee80211_debugfs_key_add(struct ieee80211_key *key)
-  {
+{
         static int keycount;
-        char buf[50];
+        char buf[100];
         struct sta_info *sta;
 
         if (!key->local->debugfs.keys)
@@ -244,7 +244,8 @@ void ieee80211_debugfs_key_add(struct ieee80211_key *key)
 
         sta = key->sta;
         if (sta) {
-                sprintf(buf, "../../stations/%pM", sta->sta.addr);
+                sprintf(buf, "../../netdev:%s/stations/%pM",
+                        sta->sdata->name, sta->sta.addr);
                 key->debugfs.stalink =
                         debugfs_create_symlink("station", key->debugfs.dir, buf);
         }
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 73abb7524b2c..54df1b2bafd2 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -119,12 +119,12 @@ static int mesh_path_sel_frame_tx(enum mpath_frame_type action, u8 flags,
         int hdr_len = offsetof(struct ieee80211_mgmt, u.action.u.mesh_action) +
                       sizeof(mgmt->u.action.u.mesh_action);
 
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom +
+        skb = dev_alloc_skb(local->tx_headroom +
                             hdr_len +
                             2 + 37); /* max HWMP IE */
         if (!skb)
                 return -1;
-        skb_reserve(skb, local->hw.extra_tx_headroom);
+        skb_reserve(skb, local->tx_headroom);
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, hdr_len);
         memset(mgmt, 0, hdr_len);
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
@@ -250,12 +250,12 @@ int mesh_path_error_tx(u8 ttl, u8 *target, __le32 target_sn,
         if (time_before(jiffies, ifmsh->next_perr))
                 return -EAGAIN;
 
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom +
+        skb = dev_alloc_skb(local->tx_headroom +
                             hdr_len +
                             2 + 15 /* PERR IE */);
         if (!skb)
                 return -1;
-        skb_reserve(skb, local->tx_headroom + local->hw.extra_tx_headroom);
+        skb_reserve(skb, local->tx_headroom);
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, hdr_len);
         memset(mgmt, 0, hdr_len);
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 41ef1b476442..a17251730b9e 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -172,7 +172,7 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
         int hdr_len = offsetof(struct ieee80211_mgmt, u.action.u.self_prot) +
                       sizeof(mgmt->u.action.u.self_prot);
 
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom +
+        skb = dev_alloc_skb(local->tx_headroom +
                             hdr_len +
                             2 + /* capability info */
                             2 + /* AID */
@@ -186,7 +186,7 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
                             sdata->u.mesh.ie_len);
         if (!skb)
                 return -1;
-        skb_reserve(skb, local->hw.extra_tx_headroom);
+        skb_reserve(skb, local->tx_headroom);
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, hdr_len);
         memset(mgmt, 0, hdr_len);
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index ecb4c84c1bb3..295be92f7c77 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -2750,7 +2750,6 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        struct ieee80211_work *wk;
         u8 bssid[ETH_ALEN];
         bool assoc_bss = false;
 
@@ -2763,30 +2762,47 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
                 assoc_bss = true;
         } else {
                 bool not_auth_yet = false;
+                struct ieee80211_work *tmp, *wk = NULL;
 
                 mutex_unlock(&ifmgd->mtx);
 
                 mutex_lock(&local->mtx);
-                list_for_each_entry(wk, &local->work_list, list) {
-                        if (wk->sdata != sdata)
+                list_for_each_entry(tmp, &local->work_list, list) {
+                        if (tmp->sdata != sdata)
                                 continue;
 
-                        if (wk->type != IEEE80211_WORK_DIRECT_PROBE &&
-                            wk->type != IEEE80211_WORK_AUTH &&
-                            wk->type != IEEE80211_WORK_ASSOC &&
-                            wk->type != IEEE80211_WORK_ASSOC_BEACON_WAIT)
+                        if (tmp->type != IEEE80211_WORK_DIRECT_PROBE &&
+                            tmp->type != IEEE80211_WORK_AUTH &&
+                            tmp->type != IEEE80211_WORK_ASSOC &&
+                            tmp->type != IEEE80211_WORK_ASSOC_BEACON_WAIT)
                                 continue;
 
-                        if (memcmp(req->bss->bssid, wk->filter_ta, ETH_ALEN))
+                        if (memcmp(req->bss->bssid, tmp->filter_ta, ETH_ALEN))
                                 continue;
 
-                        not_auth_yet = wk->type == IEEE80211_WORK_DIRECT_PROBE;
-                        list_del_rcu(&wk->list);
-                        free_work(wk);
+                        not_auth_yet = tmp->type == IEEE80211_WORK_DIRECT_PROBE;
+                        list_del_rcu(&tmp->list);
+                        synchronize_rcu();
+                        wk = tmp;
                         break;
                 }
                 mutex_unlock(&local->mtx);
 
+                if (wk && wk->type == IEEE80211_WORK_ASSOC) {
+                        /* clean up dummy sta & TX sync */
+                        sta_info_destroy_addr(wk->sdata, wk->filter_ta);
+                        if (wk->assoc.synced)
+                                drv_finish_tx_sync(local, wk->sdata,
+                                                   wk->filter_ta,
+                                                   IEEE80211_TX_SYNC_ASSOC);
+                } else if (wk && wk->type == IEEE80211_WORK_AUTH) {
+                        if (wk->probe_auth.synced)
+                                drv_finish_tx_sync(local, wk->sdata,
+                                                   wk->filter_ta,
+                                                   IEEE80211_TX_SYNC_AUTH);
+                }
+                kfree(wk);
+
                 /*
                  * If somebody requests authentication and we haven't
                  * sent out an auth frame yet there's no need to send
diff --git a/net/rds/af_rds.c b/net/rds/af_rds.c
index bb6ad81b671d..424ff622ab5f 100644
--- a/net/rds/af_rds.c
+++ b/net/rds/af_rds.c
@@ -68,7 +68,6 @@ static int rds_release(struct socket *sock)
 {
         struct sock *sk = sock->sk;
         struct rds_sock *rs;
-        unsigned long flags;
 
         if (!sk)
                 goto out;
@@ -94,10 +93,10 @@ static int rds_release(struct socket *sock)
         rds_rdma_drop_keys(rs);
         rds_notify_queue_get(rs, NULL);
 
-        spin_lock_irqsave(&rds_sock_lock, flags);
+        spin_lock_bh(&rds_sock_lock);
         list_del_init(&rs->rs_item);
         rds_sock_count--;
-        spin_unlock_irqrestore(&rds_sock_lock, flags);
+        spin_unlock_bh(&rds_sock_lock);
 
         rds_trans_put(rs->rs_transport);
 
@@ -409,7 +408,6 @@ static const struct proto_ops rds_proto_ops = {
 
 static int __rds_create(struct socket *sock, struct sock *sk, int protocol)
 {
-        unsigned long flags;
         struct rds_sock *rs;
 
         sock_init_data(sock, sk);
@@ -426,10 +424,10 @@ static int __rds_create(struct socket *sock, struct sock *sk, int protocol)
         spin_lock_init(&rs->rs_rdma_lock);
         rs->rs_rdma_keys = RB_ROOT;
 
-        spin_lock_irqsave(&rds_sock_lock, flags);
+        spin_lock_bh(&rds_sock_lock);
         list_add_tail(&rs->rs_item, &rds_sock_list);
         rds_sock_count++;
-        spin_unlock_irqrestore(&rds_sock_lock, flags);
+        spin_unlock_bh(&rds_sock_lock);
 
         return 0;
 }
@@ -471,12 +469,11 @@ static void rds_sock_inc_info(struct socket *sock, unsigned int len,
 {
         struct rds_sock *rs;
         struct rds_incoming *inc;
-        unsigned long flags;
         unsigned int total = 0;
 
         len /= sizeof(struct rds_info_message);
 
-        spin_lock_irqsave(&rds_sock_lock, flags);
+        spin_lock_bh(&rds_sock_lock);
 
         list_for_each_entry(rs, &rds_sock_list, rs_item) {
                 read_lock(&rs->rs_recv_lock);
@@ -492,7 +489,7 @@ static void rds_sock_inc_info(struct socket *sock, unsigned int len,
                 read_unlock(&rs->rs_recv_lock);
         }
 
-        spin_unlock_irqrestore(&rds_sock_lock, flags);
+        spin_unlock_bh(&rds_sock_lock);
 
         lens->nr = total;
         lens->each = sizeof(struct rds_info_message);
@@ -504,11 +501,10 @@ static void rds_sock_info(struct socket *sock, unsigned int len,
 {
         struct rds_info_socket sinfo;
         struct rds_sock *rs;
-        unsigned long flags;
 
         len /= sizeof(struct rds_info_socket);
 
-        spin_lock_irqsave(&rds_sock_lock, flags);
+        spin_lock_bh(&rds_sock_lock);
 
         if (len < rds_sock_count)
                 goto out;
@@ -529,7 +525,7 @@ out:
         lens->nr = rds_sock_count;
         lens->each = sizeof(struct rds_info_socket);
 
-        spin_unlock_irqrestore(&rds_sock_lock, flags);
+        spin_unlock_bh(&rds_sock_lock);
 }
 
 static void rds_exit(void)
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index e7e1d0b57b3d..2776012132ea 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -419,7 +419,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 
         cb = netem_skb_cb(skb);
         if (q->gap == 0 ||              /* not doing reordering */
-            q->counter < q->gap ||      /* inside last reordering gap */
+            q->counter < q->gap - 1 ||  /* inside last reordering gap */
             q->reorder < get_crandom(&q->reorder_cor)) {
                 psched_time_t now;
                 psched_tdiff_t delay;